safehaven.com Open in urlscan Pro
52.43.18.65 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://safehaven.com.admin-us2.cas.ms/
Effective URL:
https://safehaven.com/
Submission: On May 08 via automatic, source certstream-suspicious (May 8th 2020, 12:12:11 pm UTC)

Summary HTTP 218 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 53 IPs in 8 countries across 42 domains to perform 218 HTTP transactions. The main IP is 52.43.18.65, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is safehaven.com.
TLS certificate: Issued by Amazon on December 3rd 2019. Valid for: a year.

This is the only time safehaven.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	51.137.137.121 51.137.137.121	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.43.18.65 52.43.18.65	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
7	52.222.190.30 52.222.190.30	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700:303... 2606:4700:3037::6812:2030	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 27	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:633c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2600:9000:21f... 2600:9000:21f3:b400:c:5250:79c0:21	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700::68... 2606:4700::6810:85e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:20e... 2600:9000:20eb:6800:10:4f52:7800:21	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:209... 2600:9000:2093:9400:17:eca0:da80:21	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 (GOOGLE) (GOOGLE)
1	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
17	2600:9000:207... 2600:9000:2070:4200:3:442:6dc0:21	16509 (AMAZON-02) (AMAZON-02)
20	185.220.205.220 185.220.205.220	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
6	172.217.22.34 172.217.22.34	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
6	104.16.68.69 104.16.68.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	13.225.86.250 13.225.86.250	16509 (AMAZON-02) (AMAZON-02)
5	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT)
1 3	216.52.2.30 216.52.2.30	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1460	41041 (VCLK-EU-) (VCLK-EU-)
7	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
10 15	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1 3	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::6814:3677	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2a00:1450:400... 2a00:1450:4001:815::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1	23.111.11.100 23.111.11.100	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	52.222.190.102 52.222.190.102	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
2	72.247.225.32 72.247.225.32	16625 (AKAMAI-AS) (AKAMAI-AS)
21	63.250.60.138 63.250.60.138	204548 (CLOUDWEBM...) (CLOUDWEBMANAGE-IL-FR)
1 2	54.93.38.91 54.93.38.91	16509 (AMAZON-02) (AMAZON-02)
1 1	178.63.78.76 178.63.78.76	24940 (HETZNER-AS) (HETZNER-AS)
1	52.57.217.231 52.57.217.231	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
1	35.158.16.38 35.158.16.38	16509 (AMAZON-02) (AMAZON-02)
1	185.86.138.79 185.86.138.79	201081 (SMARTADSE...) (SMARTADSERVER)
2	104.109.78.125 104.109.78.125	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE)
2 4	35.158.17.58 35.158.17.58	16509 (AMAZON-02) (AMAZON-02)
1 3	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 3	63.32.144.14 63.32.144.14	16509 (AMAZON-02) (AMAZON-02)
1	72.247.225.17 72.247.225.17	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	134.209.131.220 134.209.131.220	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	91.228.74.211 91.228.74.211	27281 (QUANTCAST) (QUANTCAST)
1	2a02:fa8:8806... 2a02:fa8:8806:13::1430	41041 (VCLK-EU-) (VCLK-EU-)
218	53

1 51.137.137.121 (Cardiff, United Kingdom) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

safehaven.com.admin-us2.cas.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.43.18.65 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-43-18-65.us-west-2.compute.amazonaws.com

safehaven.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.222.190.30 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-190-30.ham50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3037::6812:2030 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:633c (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.districtm.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:21f3:b400:c:5250:79c0:21 (United States)

ASN16509 (AMAZON-02, US)

d2p6ty67371ecn.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:20eb:6800:10:4f52:7800:21 (United States)

ASN16509 (AMAZON-02, US)

d1o9e4un86hhpc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:9400:17:eca0:da80:21 (United States)

ASN16509 (AMAZON-02, US)

d32r1sh890xpii.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2600:9000:2070:4200:3:442:6dc0:21 (United States)

ASN16509 (AMAZON-02, US)

d2t794khe5w43b.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 185.220.205.220 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.22.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.68.69 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.225.86.250 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-86-250.fra2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.52.2.30 (United States) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.1.14 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1460 (Sweden)

ASN41041 (VCLK-EU-, SE)

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 185.33.221.53 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 10 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:3677 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.pushcrew.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:815::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.100 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.optmstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.190.102 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-190-102.ham50.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.247.225.32 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-32.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 63.250.60.138 (United States)

ASN204548 (CLOUDWEBMANAGE-IL-FR, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.38.91 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-38-91.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.63.78.76 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.76.78.63.178.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.217.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-217-231.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.16.38 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-16-38.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.79 (France)

ASN201081 (SMARTADSERVER, FR)

prg.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.78.125 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.158.17.58 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-17-58.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.32.144.14 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-144-14.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.225.17 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-17.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.209.131.220 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.211 (United Kingdom) 1 redirects

ASN27281 (QUANTCAST, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:13::1430 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	sekindo.com live.sekindo.com video.sekindo.com	3 MB
32	cloudfront.net d2p6ty67371ecn.cloudfront.net d1o9e4un86hhpc.cloudfront.net d32r1sh890xpii.cloudfront.net d2t794khe5w43b.cloudfront.net	2 MB
20	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	274 KB
20	advertising.com 12 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	9 KB
14	doubleclick.net 2 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	107 KB
8	adnxs.com ib.adnxs.com secure.adnxs.com acdn.adnxs.com	7 KB
8	rubiconproject.com fastlane.rubiconproject.com prebid-server.rubiconproject.com eus.rubiconproject.com	9 KB
7	adlightning.com tagan.adlightning.com	171 KB
6	districtm.io cdn.districtm.io dmx.districtm.io	323 B
6	google.de adservice.google.de www.google.de	850 B
6	googletagservices.com www.googletagservices.com	152 KB
5	google.com 1 redirects www.google.com adservice.google.com	977 B
5	amazon-adsystem.com c.amazon-adsystem.com	59 KB
5	cloudflare.com cdnjs.cloudflare.com	106 KB
5	googleapis.com fonts.googleapis.com ajax.googleapis.com	9 KB
4	yahoo.com 1 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	3 KB
4	facebook.com www.facebook.com	504 B
4	admetricspro.com qd.admetricspro.com	162 KB
4	googletagmanager.com www.googletagmanager.com	119 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	gstatic.com fonts.gstatic.com	29 KB
3	facebook.net connect.facebook.net	270 KB
3	openx.net 1 redirects teachingaids-d.openx.net eu-u.openx.net	823 B
3	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	114 B
3	lijit.com 1 redirects ap.lijit.com	1 KB
2	bidswitch.net 1 redirects x.bidswitch.net	915 B
2	dotomi.com web.hb.ad.cpe.dotomi.com aol-match.dotomi.com	743 B
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	747 B
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	quantserve.com 1 redirects pixel.quantserve.com	843 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	smartadserver.com prg.smartadserver.com	1 KB
1	loopme.me 1 redirects csync.loopme.me	224 B
1	omappapi.com api.omappapi.com	10 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	optmstr.com a.optmstr.com	60 KB
1	pushcrew.com cdn.pushcrew.com	68 KB
1	googleadservices.com www.googleadservices.com	11 KB
1	districtm.ca cdn.districtm.ca	23 KB
1	safehaven.com safehaven.com	13 KB
1	cas.ms 1 redirects safehaven.com.admin-us2.cas.ms	253 B
0	adap.tv Failed sync.adap.tv Failed
218	42

	Domain	Requested by
21	video.sekindo.com	safehaven.com live.sekindo.com
20	live.sekindo.com	safehaven.com live.sekindo.com
17	d2t794khe5w43b.cloudfront.net	safehaven.com
15	adserver-us.adtech.advertising.com	10 redirects safehaven.com
11	d2p6ty67371ecn.cloudfront.net	safehaven.com
10	pagead2.googlesyndication.com	tagan.adlightning.com pagead2.googlesyndication.com securepubads.g.doubleclick.net
10	tpc.googlesyndication.com	tagan.adlightning.com
7	tagan.adlightning.com	safehaven.com tagan.adlightning.com
6	googleads.g.doubleclick.net	1 redirects tagan.adlightning.com
6	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net safehaven.com
6	www.googletagservices.com	safehaven.com securepubads.g.doubleclick.net tagan.adlightning.com
5	secure.adnxs.com	cdn.districtm.ca
5	dmx.districtm.io	cdn.districtm.ca
5	fastlane.rubiconproject.com	qd.admetricspro.com
5	c.amazon-adsystem.com	safehaven.com c.amazon-adsystem.com live.sekindo.com
5	cdnjs.cloudflare.com	safehaven.com tagan.adlightning.com ajax.googleapis.com live.sekindo.com
4	pixel.advertising.com	2 redirects
4	www.facebook.com	safehaven.com connect.facebook.net
4	qd.admetricspro.com	safehaven.com
4	fonts.googleapis.com	safehaven.com live.sekindo.com ajax.googleapis.com
4	www.googletagmanager.com	safehaven.com
3	match.adsrvr.org	2 redirects
3	ups.analytics.yahoo.com	1 redirects safehaven.com
3	fonts.gstatic.com	safehaven.com live.sekindo.com
3	www.google.de	safehaven.com
3	www.google.com	1 redirects safehaven.com
3	connect.facebook.net	safehaven.com connect.facebook.net
3	ap.lijit.com	1 redirects qd.admetricspro.com
3	adservice.google.de	tagan.adlightning.com
3	d1o9e4un86hhpc.cloudfront.net	safehaven.com
2	eu-u.openx.net	1 redirects qd.admetricspro.com
2	eus.rubiconproject.com	live.sekindo.com qd.admetricspro.com
2	adservice.google.com	tagan.adlightning.com
2	x.bidswitch.net	1 redirects safehaven.com
2	ads.pubmatic.com	live.sekindo.com qd.admetricspro.com
2	ib.adnxs.com	qd.admetricspro.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
1	aol-match.dotomi.com
1	pixel.quantserve.com	1 redirects
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	acdn.adnxs.com	qd.admetricspro.com
1	pr-bh.ybp.yahoo.com	safehaven.com
1	cm.g.doubleclick.net	1 redirects
1	prg.smartadserver.com	live.sekindo.com
1	ads.adaptv.advertising.com	live.sekindo.com
1	prebid-server.rubiconproject.com	live.sekindo.com
1	csync.loopme.me	1 redirects
1	ajax.googleapis.com	tagan.adlightning.com
1	api.omappapi.com	a.optmstr.com
1	maxcdn.bootstrapcdn.com	safehaven.com
1	a.optmstr.com	tagan.adlightning.com
1	cdn.pushcrew.com	safehaven.com
1	teachingaids-d.openx.net	qd.admetricspro.com
1	web.hb.ad.cpe.dotomi.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	hbopenbid.pubmatic.com	qd.admetricspro.com
1	cdn.districtm.io	tagan.adlightning.com
1	stats.g.doubleclick.net	safehaven.com
1	www.googleadservices.com	www.googletagmanager.com
1	d32r1sh890xpii.cloudfront.net	safehaven.com
1	cdn.districtm.ca	safehaven.com
1	safehaven.com
1	safehaven.com.admin-us2.cas.ms	1 redirects
0	sync.adap.tv Failed	safehaven.com
218	65

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
plus.google.com

Subject Issuer	Validity	Valid
safehaven.com Amazon	`2019-12-03` - `2021-01-03`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.adlightning.com Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2019-05-23` - `2020-06-18`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
districtm.io CloudFlare Inc ECC CA-2	`2020-02-25` - `2020-10-09`	7 months	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-03-24` - `2020-06-22`	3 months	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2020-03-30` - `2022-06-25`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-04-15` - `2020-07-14`	3 months	crt.sh
*.pushcrew.com Go Daddy Secure Certificate Authority - G2	`2019-07-23` - `2021-07-31`	2 years	crt.sh
www.google.de GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.optmstr.com Go Daddy Secure Certificate Authority - G2	`2020-01-10` - `2022-01-24`	2 years	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-08-28`	6 months	crt.sh
*.smartadserver.com DigiCert Global CA G2	`2020-02-03` - `2022-02-03`	2 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-02-13` - `2020-08-11`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-04` - `2020-07-02`	6 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2017-06-14` - `2020-06-18`	3 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh

This page contains 24 frames:

Primary Page: https://safehaven.com/
Frame ID: 83D2B749799608435350CD8A921F1733
Requests: 121 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 387DB69D27F43572C438051A958A9320
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Frame ID: 2629452E1BFC57BBB13DFC71DEB0D43F
Requests: 32 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 06C6CCE90B06E9C965EC6904CBB3C6C4
Requests: 6 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 0D805ED38EE929082720B4F68FCBBD80
Requests: 17 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: F7F2634C50B0A927A584B95371014EAA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 6FFF9F31661F8C2AEC5D2DBBDF0D8E19
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: DE6DCFEEEA7FA8726AC2C5202691AA0C
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: 4E52601320E4C13946BB6A7FCF371113
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: A343B87AF7DF2C7EBBB62D08EEDC9EA2
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: EB2676FE95149EE7F3794FE284B2859B
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/zrt_lookup.html
Frame ID: 8A6DBEDDCE29BED13E6D79D6B70CB786
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913005&bpp=50&bdt=165&idt=397&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=2&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=2012639787&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1231482199072854&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.ddn6btt8lknv&btvi=1&fsb=1&dtd=410
Frame ID: C33C62F77A116E5BEC205D4606B3E279
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913282&bpp=2&bdt=424&idt=193&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=1&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=234728736&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085%2C21062175&oid=3&pvsid=1642985913830761&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.qv7wqv7l662u&btvi=1&fsb=1&dtd=197
Frame ID: 0EBC5D786247DB4E19AA470E1CEE6FB8
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: D2D30681702531813ACDE1C074BDEC15
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: CB30F0A1186F7E6C4F24F2B6B1C6D9CB
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 4A6ED440171C2968255FDBD4D6AF5D15
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 72BE8000D25AAC6979EC53A12E0AAB1D
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 231CACD7821DB78DCB04A18F9E81EA04
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Frame ID: F574492DCBA59047EE0E544035360E53
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: E1DBB326BB09B71545B6FA23EC6E40CB
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Frame ID: FAF680C22EF0B6F33090869AEFEEBE05
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 7EC0F6652E2BCC84A0B8CA295E80E745
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 1415006DFF1EDFC444B9F1600FA8C9AA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://safehaven.com.admin-us2.cas.ms/ HTTP 307
https://safehaven.com/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Amazon EC2 (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /$Amazon$/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /$Amazon$/i

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /adnxs\.(?:net|com)/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Page Statistics

218
Requests

99 %
HTTPS

44 %
IPv6

42
Domains

65
Subdomains

53
IPs

8
Countries

7110 kB
Transfer

11401 kB
Size

26
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/Safehaven_News?lang=en

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SafehavenNews/?notif_id=1519322109290495&notif_t=page_user_activity&ref=notif

Search URL Search Domain Scan URL

URL: https://plus.google.com/106909181079166580357

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://safehaven.com.admin-us2.cas.ms/ HTTP 307
https://safehaven.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=1798720709&t=pageview&_s=1&dl=https%3A%2F%2Fsafehaven.com%2F&ul=en-us&de=UTF-8&dt=Safehaven.com%20%7C%20Preservation%20of%20Capital&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1261889471&gjid=533855615&cid=2139183475.1588939911&tid=UA-2249023-27&_gid=2008974282.1588939911&_r=1&gtm=2oa4t0&z=1431076528 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=2139183475.1588939911&jid=1261889471&_gid=2008974282.1588939911&gjid=533855615&_v=j82&z=1431076528

Request Chain 65

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1A199a6d32-9125-11ea-b9a7-123c39a1c2a0;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538

Request Chain 66

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1A19953e7a-9125-11ea-8f87-120f1417a350;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538

Request Chain 67

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1A199b1d2c-9125-11ea-8e0d-1283af18fee8;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538

Request Chain 68

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1A199ae38e-9125-11ea-81e9-12c8450abec2;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538

Request Chain 69

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538

Request Chain 87

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/?random=1588939911709&cv=9&fst=1588939911709&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&is_vtc=1&random=2964737342&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&is_vtc=1&random=2964737342&resp=GooglemKTybQhCsO&ipr=y

Request Chain 129

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent=

Request Chain 130

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=6ccdde4d-ba96-42a8-9aac-c154e7e3e51e

Request Chain 189

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46&verify=true

Request Chain 190

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XrVMiQAAAFxK0goD HTTP 302
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVMiQAAAFxK0goD&_test=XrVMiQAAAFxK0goD

Request Chain 192

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852 HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46

Request Chain 207

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1 HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1

Request Chain 209

https://ap.lijit.com/beacon?informer=13394437 HTTP 302
https://ap.lijit.com/beacon?informer=13394437&dnr=1

Request Chain 210

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 212

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=60nPd-pPlSDzGplx6B-Acu0UlSHzHsxx6hwSpL8k

218 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
safehaven.com/
Redirect Chain

https://safehaven.com.admin-us2.cas.ms/
https://safehaven.com/

92 KB
13 KB

571ms
218ms

Document
text/html

52.43.18.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.43.18.65 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-43-18-65.us-west-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: 1ed6f6d8afefec7d237e704184698b3e1b41608f0e98ec5be077d940f66a2697

Request headers

:method: GET
:authority: safehaven.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 08 May 2020 12:11:50 GMT
content-type: text/html; charset=UTF-8
content-length: 12980
set-cookie: AWSALB=ugTVFEDq1ONNZhZHz25AAK62MyqNzFbanz8CR+vah6FToKyfawTiVGU0CY1AB7IXLgfrKUAs+T8M4rbt6hU7ZLpjRWnWiz0YTRGbaXnkBVLPyE4FnjzywyYwm5ng; Expires=Fri, 15 May 2020 12:11:50 GMT; Path=/ AWSALBCORS=ugTVFEDq1ONNZhZHz25AAK62MyqNzFbanz8CR+vah6FToKyfawTiVGU0CY1AB7IXLgfrKUAs+T8M4rbt6hU7ZLpjRWnWiz0YTRGbaXnkBVLPyE4FnjzywyYwm5ng; Expires=Fri, 15 May 2020 12:11:50 GMT; Path=/; SameSite=None; Secure csrf_safehaven_cookie=c476e6edc55ce3b23ed7175c17b9bf8a; expires=Fri, 08-May-2020 14:11:50 GMT; Max-Age=7200; path=/ safehaven_ci=c49f2a853a66b771fd6f9811b5194d3d4d1daa5a; path=/; HttpOnly
server: Apache/2.4.41 (Amazon) PHP/5.6.40
x-powered-by: PHP/5.6.40
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip

Redirect headers

Date: Fri, 08 May 2020 12:11:50 GMT
Connection: keep-alive
Location: https://safehaven.com/
Strict-Transport-Security: max-age=31536000
Content-Length: 136
X-MCAS-Request-Id: 8dfb0138-bae8-41ac-b573-b6acf9a3eb24

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
30 KB 32ms
28ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1f2adccbf7066f001f789789a63d42dcc90b43abb28455ba7d36bf96fc02578

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30413
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:50 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 29ms
25ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-814550776

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b124b3787031cfbe2946d1e124d4ecb3affa8b1619b81cf247d851b242785b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30412
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:50 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
690 B 18ms
14ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500&display=swap

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a837fab08c038562b05eb2eb81c1c340c8cd2762d2c43d5e3bb26c2980fc9bfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 12:11:50 GMT
server: ESF
date: Fri, 08 May 2020 12:11:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 12:11:50 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids/ 33 KB
12 KB 50ms
15ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/op.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b3fc91a1ad52d699828c32fab5b6c562dd9b6e7f287bd300b589a9f010a60a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: vvF6bEuHBPTp.JE4kH7JRYXw5MKJYiVY
content-encoding: gzip
etag: "c9355861af30ba2acaee28d29cbfb015"
age: 843
x-cache: Hit from cloudfront
status: 200
content-length: 12063
x-amz-meta-git_commit: 0d4dfcb
last-modified: Thu, 07 May 2020 23:03:16 GMT
server: AmazonS3
date: Fri, 08 May 2020 11:57:48 GMT
content-type: application/javascript
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: yfa9zAc4e8usZIg1CtdtLR666xipk9bA6EW741bcxJMr_TTqkAWKVg==

GET
H2 200 layout.js Show response
qd.admetricspro.com/js/safehaven/ 14 KB
2 KB 596ms
548ms Script
application/javascript 2606:4700:3037::6812:2030
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/layout.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6812:2030 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 267de44d3e0da48ea910544cc6ae698dc28c977de6cb7baf62a4913765f49a2b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 03 Apr 2020 17:20:45 GMT
server: cloudflare
status: 200
etag: W/"3905-5a266233b698f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 590315ead86405e4-FRA
cf-request-id: 0295cc06c7000005e40a97b200000001
expires: Fri, 08 May 2020 12:21:51 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 44 KB
14 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e85be7f78cb2c4957c023256ac897c1d6b559971337821d55f70e5e2809f103c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "509 / 189 of 1000 / last-modified: 1588867901"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 14583
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:50 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/safehaven/ 218 KB
61 KB 227ms
178ms Script
application/javascript 2606:4700:3037::6812:2030
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/cmp.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6812:2030 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 27 Sep 2019 21:07:46 GMT
server: cloudflare
status: 200
etag: W/"367ba-5938f47194c80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 590315ead86605e4-FRA
cf-request-id: 0295cc06c7000005e40a97c200000001
expires: Fri, 08 May 2020 12:21:50 GMT

GET
H2 200 merge.142016.js Show response
cdn.districtm.ca/merge/ 96 KB
23 KB 50ms
22ms Script
application/x-javascript 2606:4700::6812:633c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.ca/merge/merge.142016.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:633c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d847475ca969f76b8f8421c4150f23fbe5bef200839b80481b845a6ccdd6e86f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 152243
cf-polished: origSize=98705
status: 200
last-modified: Mon, 09 Sep 2019 19:18:19 GMT
x-amz-request-id: 9445A9EB2D8C95D0
x-amz-id-2: qd4YUTJ7ej/awokk1hdGiEuKwY43QuD55Jy+MEAYZiJPsVg16PAZcyXugM9DGW0KcY/AgIlzRao=
cf-bgj: minify
server: cloudflare
etag: W/"af89e858721db33fe8776b832f2f75a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
x-amz-version-id: W3M7ZtQBM6rvV9.80JF8eLB1ASMBDZAU
cf-request-id: 0295cc06b4000006144f3b5200000001
cf-ray: 590315eabe4d0614-FRA
expires: Fri, 08 May 2020 16:11:50 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/safehaven/ 294 KB
86 KB 203ms
155ms Script
application/javascript 2606:4700:3037::6812:2030
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6812:2030 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 26 Feb 2020 03:30:32 GMT
server: cloudflare
status: 200
etag: W/"49929-59f723a0fd39e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 590315ead86705e4-FRA
cf-request-id: 0295cc06c7000005e40a97d200000001
expires: Fri, 08 May 2020 12:18:05 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/safehaven/ 16 KB
12 KB 197ms
149ms Script
application/javascript 2606:4700:3037::6812:2030
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/engine.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6812:2030 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 24 Nov 2019 00:06:08 GMT
server: cloudflare
status: 200
etag: W/"41f6-5980c69fe949d-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 590315ead86905e4-FRA
cf-request-id: 0295cc06c7000005e40a97e200000001
expires: Fri, 08 May 2020 12:18:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-820290545

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f703cc979ec1a42c38021c0daf9993d4e72ed4f947445d04e84af951ae6d236

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30410
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:51 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-802310072

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

41a3ed238e5ec4c932b6f0bd9f39801b903a55a82c4620e6c9d3a9a9e73e3811

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30411
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:51 GMT

GET
H2 200 style.css
d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/ 72 KB
11 KB 44ms
7ms Stylesheet
text/css 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: 0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:59:06 GMT
content-encoding: gzip
age: 601964
x-powered-by: PHP/5.6.40
x-cache: Hit from cloudfront
status: 200
content-length: 10330
last-modified: Fri, 01 May 2020 12:38:59 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
etag: "pub1588336739;gz"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: hphVVvH31DKP0hEL497VWid1mhoHLZji5m01UbxiCD2ikDE00ZShLg==
expires: Sat, 01 May 2021 12:59:06 GMT

GET
H2 200 jquery-1.12.3.min.js Show response
d2p6ty67371ecn.cloudfront.net/a/js/third_party/ 95 KB
33 KB 47ms
10ms Script
text/javascript 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/js/third_party/jquery-1.12.3.min.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 13:07:55 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 15:47:55 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 83035
etag: "17b9c-5a4981ad75a46-gzip"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 33794
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
x-amz-cf-id: P4YZLNcvmh3v2srehwLFQ-6wiyof8SExHvyaz5uPA93NFKTku13K1w==

GET
H2 200 cookieconsent.min.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 4 KB
1 KB 14ms
12ms Stylesheet
text/css 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 16434137
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295cc069a0000d72190960200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:18:36 GMT
server: cloudflare
etag: W/"5afd48ec-f62"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 590315ea9b60d721-FRA
expires: Wed, 28 Apr 2021 12:11:50 GMT

GET
H2 200 cookieconsent.min.js Show response
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 19 KB
6 KB 14ms
13ms Script
application/javascript 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 24899046
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295cc069a0000d72190961200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:18:32 GMT
server: cloudflare
etag: W/"5afd48e8-4d5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 590315ea9b62d721-FRA
expires: Wed, 28 Apr 2021 12:11:50 GMT

GET
H2 200 logo-no-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 18 KB
18 KB 8ms
8ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/logo-no-light.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:39:02 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601974
etag: "470b-5a495775215b8"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 18187
x-amz-cf-id: 2iNDaVK6jij3K26g_r1v4LTRFftKDBbpBL7GVPShL-bD4vMVR0dz9A==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 logo-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 15 KB
16 KB 7ms
6ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/logo-light.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:57 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:07 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601974
etag: "3d01-5a49574111890"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 15617
x-amz-cf-id: xXHn9Ry-D7kWxvwqozZvJ38xHmDSUWS4YdZ9mf0VLsSNiv3SKBM2LA==
expires: Fri, 08 May 2020 12:58:57 GMT

GET
H2 200 chart_green.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 32 KB
5 KB 40ms
7ms Image
image/svg+xml 2600:9000:20eb:6800:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_green.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:6800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: 698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 22:21:45 GMT
content-encoding: gzip
age: 1432206
x-cache: Hit from cloudfront
status: 200
content-length: 4218
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "80e2-591a1da78e7ac-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: Fh7-jO2PrX67iadSIkJHEb0-xxV4O4xnOJClxpc3gXo-1-_kRx1TOA==
expires: Wed, 21 Apr 2021 22:21:45 GMT

GET
H2 200 chart_red_flip.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 15 KB
2 KB 7ms
6ms Image
image/svg+xml 2600:9000:20eb:6800:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_red_flip.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:6800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 04:58:04 GMT
content-encoding: gzip
age: 1322027
x-cache: Hit from cloudfront
status: 200
content-length: 1798
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "3ca0-591a1da7a5eac-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: trSx6howmTWdVRRPo5Gi0TthvmQ2nuNqW_w7CJ1e2LYYIOqeYPn8tQ==
expires: Fri, 23 Apr 2021 04:58:04 GMT

GET
H2 200 chart.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 27 KB
4 KB 7ms
6ms Image
image/svg+xml 2600:9000:20eb:6800:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:6800:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 16:54:49 GMT
content-encoding: gzip
age: 1451822
x-cache: Hit from cloudfront
status: 200
content-length: 4143
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "6c58-591a1da77804c-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: PtmljJJYLBInR3TojVy3PFFyW-cDB7eCQ3jLv_1fUU3R_T7lw2eN7A==
expires: Wed, 21 Apr 2021 16:54:48 GMT

GET
H2 200 blend_45_2.png
d32r1sh890xpii.cloudfront.net/header_graphs/ 7 KB
7 KB 438ms
401ms Image
image/png 2600:9000:2093:9400:17:eca0:da80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d32r1sh890xpii.cloudfront.net/header_graphs/blend_45_2.png?cb=1588939802
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:9400:17:eca0:da80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 94825a38fe05eb8161707b3783b7ad8e3405d2b9cb6a4e8b2e3c2390dedba33a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 acc2c574ca468bfb1281581bb9fd9e8a.cloudfront.net (CloudFront)
last-modified: Fri, 08 May 2020 12:11:04 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C1
etag: "e3e7a7f38b34ce738db5dc967494c3c3"
x-cache: Miss from cloudfront
x-amz-version-id: 3wZxsbo6mbwudDr0Wboh.bo8_qyxuyor
status: 200
accept-ranges: bytes
content-type: image/png
content-length: 6755
x-amz-cf-id: ASySyZB62ZO0fgugVYBCjWk_O6L7NYuULFGCa6QppgmAfizj75-Rhw==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-814550776

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 4532
date: Fri, 08 May 2020 10:56:19 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Fri, 08 May 2020 12:56:19 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 28 KB
11 KB 20ms
19ms Script
text/javascript 172.217.22.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-814550776

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s18-in-f98.1e100.net

Software

cafe /

Resource Hash

65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 10877
x-xss-protection: 0
server: cafe
etag: 12200185889747903800
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 12:11:51 GMT

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ 36 KB
13 KB 23ms
15ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 16:40:46 GMT
content-encoding: gzip
age: 761466
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: gXSmEGF7zXrQvpESIU5lEUqNouputV2UmM5m4vRByLqHJXF5Rzoj2w==

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ 95 KB
40 KB 24ms
17ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:04:46 GMT
content-encoding: gzip
age: 47226
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: U1DYjfhwe7nacVFTu0iBbfmNFYnZWQXSpVqKUAYCvdFSXIvfM5EkgQ==

GET
H2 200 d525cbbcfcc58cae512c785390df5573.jpg
d2t794khe5w43b.cloudfront.net/article/718x300/ 158 KB
158 KB 487ms
439ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/718x300/d525cbbcfcc58cae512c785390df5573.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2886cb37ae9565ff853f695f1dd901549ef29661d21f4a9633d544bf8dd7c757

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 22:06:15 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "a0edcbcb7e1d191a3f0521a45cbf1f34"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 161663
x-amz-cf-id: yCFN7SukEIP8DEv8uiWOWWPl3dPQJiM0zB5_5svtNN-iwpBddZHnjw==

GET
H2 200 6621b228fc8ca701e71b6b6dce79ee45.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 65 KB
65 KB 93ms
46ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/6621b228fc8ca701e71b6b6dce79ee45.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6d40fc6a27a558f6f09b142ba587591cfe9d4f86ab0fd015a0c39ae9fb90e8eb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 06:19:36 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 21:53:38 GMT
server: AmazonS3
age: 21136
etag: "33bbc0ca370e6b0d264c2cb577496e2c"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-length: 66622
x-amz-cf-id: 3iovtrvQQhEeD5NtmVWFlxUMV2hXJgidn6hPAxmFRGQOO48ntDxBtQ==

GET
H2 200 06685a2a5b9c31966c9019d4bbe755e2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 106 KB
106 KB 540ms
493ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/06685a2a5b9c31966c9019d4bbe755e2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40fddc2a37b32e799d931b5bf87c338cc2eaf4be9591afb587e0ccb565f4fd65

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 17:25:15 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "8f1b5455e9872a5243e7f8b9341ed1e5"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 108242
x-amz-cf-id: kw4tc0hIKMGX-aW3lA-9HxpGup-zcZHVdgIGrsR8nV2VssWQphHY6Q==

GET
H2 200 ce90c17bd3f82f17513ec156d1ba9210.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 83 KB
84 KB 541ms
494ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/ce90c17bd3f82f17513ec156d1ba9210.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 95db8a9b223e23289fdaca9a64bceddf52771d09ab7fabf6f72fa450c414810e

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 22:43:36 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "e56d9e5b0b408b0e577ff0e04fa76476"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 85501
x-amz-cf-id: rIiBd6JMgr6za3Eknwv4lm_imypg9FoOy-LeLzHuvjgR3wdqCeh3-w==

GET
H2 200 18ce4a9a9ea22f74b625a00aeca39e83.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 91 KB
91 KB 67ms
21ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/18ce4a9a9ea22f74b625a00aeca39e83.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a96de9b5cab3a965483ca1974e4c89f6e16b77ce6aa09ec9b58921a3da0778cd

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 06:19:36 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 22:46:19 GMT
server: AmazonS3
age: 21136
etag: "d45723af9b2303ea969d039a636798f0"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-length: 92895
x-amz-cf-id: mkG-RqfMLie-FcGI1UN-7yTAgXfd4QvwTxvKbTxxzsTpNW1XuYZuuw==

GET
H2 200 fddaed69a2bed88ad92c38982f93686e.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 183 KB
184 KB 539ms
492ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/fddaed69a2bed88ad92c38982f93686e.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b028c2df0b60ae6849af0ddee92ff49d080d5cf91041bae321397f5bb046d1e9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 14:21:32 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "73a453c9a0128143f366b1e5e56572ea"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 187395
x-amz-cf-id: vSYGJurBbUIFWFOk9wOp9tfhp6w2xa_XZbLnD6Sia0Jp6-59zCm7tg==

GET
H2 200 ccfa8ff892d2412b5b1ae6c85cf706a2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 128 KB
129 KB 493ms
492ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/ccfa8ff892d2412b5b1ae6c85cf706a2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8c17613217b11da7589afe53aa138606274ad5c49d5638d5275b5ab4bbd76dcb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 14:32:10 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "d7cd76130dc2ef962b685abedf8ef9c7"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 131326
x-amz-cf-id: HSrM3qYlCSuyiKHiENK9bSdBbh0iwZQBVi9Lf8_ZGDUVuh1jCNNFKw==

GET
H2 200 30b468439cea58f3e4135f3fbb2e20d2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 109 KB
110 KB 493ms
492ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/30b468439cea58f3e4135f3fbb2e20d2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a02e6cb846a5e7a2d7f10a40c60be5d5f6bf9f432e994e688990712714cd4eb0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 22:47:38 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "4c6d29b561bb462e16ef8238940f2ead"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 112086
x-amz-cf-id: o6oUT8AqjIzY0bq3oxlk-4EMnAwsfqbMQUxdF4Rry77HCfb3ueS3AQ==

GET
H2 200 2467be954d2ff73b7199a69b51464cd1.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 98 KB
99 KB 439ms
438ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/2467be954d2ff73b7199a69b51464cd1.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 29bb72af92ce3a332ed2315043b17307ae458d3e3b7e24db3bb47417d6e433f8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 22:46:32 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "18e1f4f94202668fce19bf47650863b1"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 100506
x-amz-cf-id: gC8uW34oo413eZ_6Zxz9yW85sdiNrryrWXSSCBi8CBNHEOt2tnEVeQ==

GET
H2 200 5025bd44e126ebf179feab18da0eaa47.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 78 KB
78 KB 440ms
439ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/5025bd44e126ebf179feab18da0eaa47.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 968f52680af792b0d892af779cdfc6a197c35698450088340c6a471b2e056a7d

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 16:38:51 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "840ef35851453999ff445bb7251a9167"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 79470
x-amz-cf-id: KpddCW4ac0hQBzRcG4lRJ5xEfcpNGxibtTK5rTpa5DgLLmLWouTY0w==

GET
H2 200 6309ec9f3c9fc848f32290cb165930ec.png
d2t794khe5w43b.cloudfront.net/article/495x320/ 280 KB
281 KB 494ms
493ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/6309ec9f3c9fc848f32290cb165930ec.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 579d29f71b15657f86363fa09f655d4f41e3023e9601e46d81f56010eef88844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 15:01:19 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "a46dbed618ed4de0683aff8615941684"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 286986
x-amz-cf-id: N9Rn2OqwxkxlDwnVUF2r2agLVa7ga9UuqZDNmb4hO5Nl5ZIPkU9rSA==

GET
H2 200 f51c4a5589c03415f84e2013ed34afe5.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 74 KB
74 KB 494ms
493ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/f51c4a5589c03415f84e2013ed34afe5.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a032bc143a0d78657b8ef39bd54084bfe9d5857f89cede4e17029bf6b7b08c91

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 21:14:18 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "28fd66f11a884598c0f05804eccb57eb"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 75274
x-amz-cf-id: 6Fz8ve6iJimUd7VFbvQQJo28lhHXcii5M7HQFxORqKRAr9rtm86kTg==

GET
H2 200 bae06b43a843f4d575bc458f3e8516d7.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 69 KB
69 KB 439ms
438ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/bae06b43a843f4d575bc458f3e8516d7.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f7aa5dfd1c09d9e48906ac4a86bb8d2335685bd7dfaeff60005cfb7d4d257cc

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 21:11:36 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "309925db1294d77fe170e0e602c308ea"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 70279
x-amz-cf-id: BO3q5lJHJNeVyposAPTV7NrgaKtKHCn3jTmvU7zJxnvTJ9XAdPZ_9g==

GET
H2 200 dfd685fa44ac7fd67fc0e81c31bce7da.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 88 KB
88 KB 398ms
397ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/dfd685fa44ac7fd67fc0e81c31bce7da.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d9c80f88c3b68f5aa70d72e6cc3ee2b63c7304ae2d7d5a0699b2fde98d4e1100

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 10:48:36 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 18:02:34 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "2242d3872e81ce688b35032a4cabf0cf"
x-cache: RefreshHit from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 89850
x-amz-cf-id: KvSB_157gA2K2pJjUAPDx2A0BUQy1EgLfDFOJfRkfVvQkdGOgb8q1Q==

GET
H2 200 18554b728b50fbabca02c5555043c903.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 104 KB
104 KB 439ms
438ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/18554b728b50fbabca02c5555043c903.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f6a0f2ed3d7266da65abffc40108aff7ec33d6d63a020893de90235e66dc78f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 20:55:49 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "f33bb7c52c6a52dbb1616989d9df9da4"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 106310
x-amz-cf-id: a8FbbUrEhhGl3OGoL49jF329zAYupgG5jtIL5NKie81m4HySiZnoBQ==

GET
H2 200 8f97c6eb6a891ccd9e1a41bf68d1b2be.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 147 KB
148 KB 494ms
493ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/8f97c6eb6a891ccd9e1a41bf68d1b2be.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 62e5d5f4a0db067e567962cfe7b9b938e4a0b6a7c5cc2c72f822caad1d5388f9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 20:12:18 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "0678700f5cec00da4f71216a1492efe7"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 150844
x-amz-cf-id: rWx6NL_DLUw-zngg21BQi1jJelIveZNv83Ngkzj42Kholjv84exddA==

GET
H2 200 c118366afd0d19c430611f527a871002.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 103 KB
104 KB 440ms
439ms Image
application/octet-stream 2600:9000:2070:4200:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/c118366afd0d19c430611f527a871002.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2070:4200:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a492f8c0fdbb910dbabf2370b67bcd120f5c82f974104e30c9307f152c2025c1

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
via: 1.1 17b6d0f022cb338e07d6581877453bb0.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 15:34:28 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C3
etag: "9d5d9b7aa09952711acb11cd66c6232f"
x-cache: Miss from cloudfront
content-type: application/octet-stream
status: 200
accept-ranges: bytes
content-length: 105958
x-amz-cf-id: nmrn2cdEiYUXKxloROTRVUS6_Vz8zuimaiFJ2Jk_uYRIld_gxdLV2w==

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 25 KB
7 KB 76ms
21ms Script
text/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 1ae2e5ebdd5c2566b863b9b71843f509648470c8a5f8f7ed5d8ed01d33705a9f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:50 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2 200 envolope.png
d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/ 21 KB
21 KB 15ms
9ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/envolope.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:09 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601975
etag: "543c-5a49574283abe"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 21564
x-amz-cf-id: DN-Ydv2OhHId9rX5oTFsXcXKY8tP9q_EQY1dSM5wczxLcsGoBoJlAQ==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 twitter.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 17ms
12ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/twitter.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:59 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601975
etag: "3bd9-5a4957729cdfc"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 15321
x-amz-cf-id: fBV6Z7VnPWssNrU-ZdegqwQkzkYV7FJur7sqeYloCbf0NC7Mphn4kw==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 facebook.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 19ms
14ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/facebook.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:34 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601975
etag: "3b58-5a49575a292c3"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 15192
x-amz-cf-id: UmaRG1gyv5WQtnv4_u4zyTFjKN9hUdl2JQdLodzljSckceGxDtkJDg==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 google-plus.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 17ms
12ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/google-plus.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:32 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601975
etag: "3c67-5a495758e012a"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 15463
x-amz-cf-id: C-w85VkAbw3qRqFE5RBpFNe0_onBxhTkHzMHKOVbKrFME-sWpPm49A==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 rss.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 18ms
13ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/rss.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:09 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601975
etag: "3c51-5a4957425aa76"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 15441
x-amz-cf-id: 8TnKV--7iHno52F0kGinpo47tzCIotza7GOPkiSc6rQrjzeSRnVOMA==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 script.js Show response
d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/ 15 KB
5 KB 8ms
8ms Script
application/x-javascript 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/script.js?v=27
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: 18cada9261c4f9c200316900d6ab365a430781e234591b7032028bdb2bad7192

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:59:07 GMT
content-encoding: gzip
age: 601964
x-powered-by: PHP/5.6.40
x-cache: Hit from cloudfront
status: 200
content-length: 4389
last-modified: Fri, 01 May 2020 12:39:00 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
etag: "pub1588336740;gz"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: SzKpnVlFHz0MTlvgOUfAV3mbfp2ntxI4gNT3PWCF9V1IgsRiYdPOxg==
expires: Sat, 01 May 2021 12:59:07 GMT

GET
H2 200 pubads_impl_2020050602.js Show response
securepubads.g.doubleclick.net/gpt/ 243 KB
87 KB 17ms
17ms Script
text/javascript 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

sffe /

Resource Hash

c4b5c1f949f059e3abb05ddcb7cc9944f8c16811e0eb1db9003bc5f8a4eb0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 May 2020 17:23:28 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89224
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:51 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
178 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 108
x-xss-protection: 0

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=1798720709&t=pageview&_s=1&dl=https%3A%2F%2Fsafehaven.com%2F&ul=en-us&de=UTF-8&dt=Safehaven.com%20%7C%20Preservation%20of%20Capital&sd=...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=2139183475.1588939911&jid=1261889471&_gid=2008974282.1588939911&gjid=533855615&_v=j82&z=1431076528

35 B
102 B

15ms
14ms

Image
image/gif

2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=2139183475.1588939911&jid=1261889471&_gid=2008974282.1588939911&gjid=533855615&_v=j82&z=1431076528

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 08 May 2020 12:11:51 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=2139183475.1588939911&jid=1261889471&_gid=2008974282.1588939911&gjid=533855615&_v=j82&z=1431076528
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 419
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 387D 0
0 61ms
22ms Document
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 204
date: Fri, 08 May 2020 12:11:51 GMT
set-cookie: __cfduid=d296ce3c9202944bd979bcfb69ef996401588939911; expires=Sun, 07-Jun-20 12:11:51 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 590315ef1c9e0c29-AMS
cf-request-id: 0295cc096e00000c29f987a200000001

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 101 KB
26 KB 35ms
13ms Script
application/javascript 13.225.86.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 20:13:12 GMT
content-encoding: gzip
server: Server
age: 57518
etag: ad48a5f558eb50f381edaa87211f6c91
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: KQP-LnyOMBgrZTEoAbGphbDW87-iIQ_Zw3yMvpPeGJoj0wSvnZ0hyA==
via: 1.1 edfd22ec6695cdc9d7ac634220af1315.cloudfront.net (CloudFront)

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 140ms
103ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=15&p_pos=atf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=625a1827-6cfb-4122-b5a9-8110f2e72623&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7191014813622627
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: ca2fad3c80b0a8729a7ae3c47aa2849e078d1b3fb4bd9e4079f6b1988bb8f8bd

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=22
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 136ms
99ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=15&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=b2a7773e-213c-48ea-8936-268648b1629b&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.08851043356957922
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 9358fd042faa601e271fb4c03ce8cbf093414c7dff34e8e54a24d002da113be5

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=289
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 154ms
116ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244366&size_id=15&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=0f1047a9-90aa-4425-be85-ddcc4d45fa4a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.23029191246979663
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: c761e867921c708aad4ff9a03b9ee666830676748d786aa2d7ddec1db29b7c9c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=217
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 119ms
80ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=2&p_pos=atf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=a649052e-83ef-41c6-b0a2-20af309d6f92&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.566924302600589
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 57273b1b7ecb9a6694127380c29ce2a2e62c62b1241f06b743666336a297140e

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=312
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 142ms
101ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=2&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=fbf753e3-08f7-4950-9294-ddd285fb18c1&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7266719424276553
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 034024b3b8ae65014e2607e66694bf730d14b8e693440b47a98f6f06ec93de5b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=406
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 47 B
722 B 138ms
99ms XHR
application/json 216.52.2.30
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.8.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 8a9b040dfe4db54da8ad79d37d7c159a5652a5d89c649ddc59fc4e48b4096479

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://safehaven.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 65

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
114 B 190ms
149ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 08 May 2020 12:11:51 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://safehaven.com

POST
H2 200 v2 Show response
e.serverbid.com/api/ 711 B
648 B 333ms
119ms XHR
application/json 167.172.1.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.172.1.14 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: br
status: 200
vary: Origin
content-type: application/json
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
content-length: 372

POST
H2 200 24 Show response
web.hb.ad.cpe.dotomi.com/s2s/header/ 456 B
639 B 37ms
12ms XHR
application/json 2a02:fa8:8806:16::1460
VCLK-EU-

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: 1e0d896233604f645a0c71f3e3c5a0cb0406cb99a911f7d224f7d74070eeec02

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 200
content-type: application/json
access-control-allow-origin: https://safehaven.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 456
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 609 B
1 KB 67ms
35ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

46d112262e853b8310ff86f0432a4cf1856043609603879cefa976637db99b93

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 May 2020 12:11:53 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.182:80
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 6850b3ac-7eaa-487b-b3d3-d4db6da0d828
Server: nginx/1.13.4
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ADTECH;apid=1A199a6d32-9125-11ea-b9a7-123c39a1c2a0;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1A199a6d32-9125-11ea-b9a7-123c39a1c2a0;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=15...

945 B
1 KB

190ms
188ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1A199a6d32-9125-11ea-b9a7-123c39a1c2a0;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 24c680d1584ba46d015f9d4a8c4ea0adaa53be3f1f798310e9273163b0af8330

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1A199a6d32-9125-11ea-b9a7-123c39a1c2a0;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=56b168eb6ac5c49;misc=1588939911538
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A19953e7a-9125-11ea-8f87-120f1417a350;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1A19953e7a-9125-11ea-8f87-120f1417a350;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=15...

945 B
1 KB

250ms
248ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1A19953e7a-9125-11ea-8f87-120f1417a350;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 85983c4006e7ba32a14061bb4b1b6800f912e4eaebe1ba0244e17515c6f52272

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1A19953e7a-9125-11ea-8f87-120f1417a350;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=5750c86ebf5b4ac;misc=1588939911538
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A199b1d2c-9125-11ea-8e0d-1283af18fee8;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1A199b1d2c-9125-11ea-8e0d-1283af18fee8;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=15...

944 B
1 KB

190ms
189ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1A199b1d2c-9125-11ea-8e0d-1283af18fee8;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a19e5cb1dcf4a0e6b7df6307f8105c907eed64538b3f35784319b8b643332232

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1A199b1d2c-9125-11ea-8e0d-1283af18fee8;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=582c1ebb9b7c9d1;misc=1588939911538
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A199ae38e-9125-11ea-81e9-12c8450abec2;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1A199ae38e-9125-11ea-81e9-12c8450abec2;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=15...

945 B
1 KB

189ms
188ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1A199ae38e-9125-11ea-81e9-12c8450abec2;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: c1e29d01c1f61adc2d02296035030ab1f4356bc04cae2d3c9f6f7baf653848f1

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1A199ae38e-9125-11ea-81e9-12c8450abec2;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=59181e86c990db1;misc=1588939911538
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588939910;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=15...

944 B
1 KB

172ms
172ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a25cfe179c17974ae9abe4af5e5e56e42b2657c18903d8f1f3f6f9b695f3e782

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46;cfp=1;rndc=1588939911;v=2;cmd=bid;cors=yes;alias=60ee5b41b4b6cdc;misc=1588939911538
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 172 B
569 B 55ms
26ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsafehaven.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=625a1827-6cfb-4122-b5a9-8110f2e72623%2Cb2a7773e-213c-48ea-8936-268648b1629b%2C0f1047a9-90aa-4425-be85-ddcc4d45fa4a%2Ca649052e-83ef-41c6-b0a2-20af309d6f92%2Cfbf753e3-08f7-4950-9294-ddd285fb18c1&nocache=1588939911540&pubcid=0a0602ca-b3e9-4efc-a986-146d7210f3d1&schain=1.0%2C1!admetricspro.com%2C102%2C1%2C%2C%2C&aus=300x250%7C300x250%7C300x250%7C728x90%7C728x90&divIds=div-gpt-ad-1553475674669-0%2Cdiv-gpt-ad-1553475817787-0%2Cdiv-gpt-ad-1553475909622-0%2Cdiv-gpt-ad-1553475988342-0%2Cdiv-gpt-ad-1553476044183-0&auid=540800705%2C540800706%2C540800707%2C540800708%2C540800709&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.185.0 /
Resource Hash: bcbd3e81a658d08ccaf161f71a02478d6c355a9affd9a2325cb9e912b8f2fab9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
server: OXGW/16.185.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://safehaven.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 605 B
1 KB 69ms
41ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

519af704ada6648c0dec5ac7317ff903600ece818b61217fd43e64b8127259b2

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 May 2020 12:11:53 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 17f47276-01da-4019-9c21-339c0f8b98f7
Server: nginx/1.13.4
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 131 KB
31 KB 10ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id: 1814657579
pragma: public
x-fb-debug: h30m8qUprexk/qA8TO40VtqKlc5z85E04i62jtS6lV038HqUr0iDX3O/LaMZj3u2QDkcKBwfFIMCZsYPjcCIYg==
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: DENY
date: Fri, 08 May 2020 12:11:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
status: 200
cache-control: public, max-age=1200
vary: Accept-Encoding
content-length: 31766
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ee70c0a7d2f14ec08939692fc7857b11.js Show response
cdn.pushcrew.com/js/ 237 KB
68 KB 15ms
13ms Script
application/javascript 2606:4700:10::6814:3677
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pushcrew.com/js/ee70c0a7d2f14ec08939692fc7857b11.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c79ada16090cc7e94af116173695bfd88da9efe580f89749e1160ba9d49c54c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 614
status: 200
cf-request-id: 0295cc09a60000d6e5219b1200000001
access-control-allow-origin: *
last-modified: Thu, 09 Apr 2020 07:33:27 GMT
server: cloudflare
etag: W/"5e8ecfc7-3b3a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
via: 1.1 google
cache-control: max-age=43200
cf-ray: 590315ef7b40d6e5-FRA
expires: Fri, 08 May 2020 12:31:37 GMT

GET
H2 200 search.png
d2p6ty67371ecn.cloudfront.net/a/img/ 770 B
1 KB 15ms
14ms Image
image/png 2600:9000:21f3:b400:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/search.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b400:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d

Request headers

Referer: https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:58 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:08 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 601973
etag: "302-5a495741b9834"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 770
x-amz-cf-id: cfwLMv6x19NR4Lw99v9EWJOteRhsa2yG1DIhghye06vwcomhzd8C3g==
expires: Fri, 08 May 2020 12:58:58 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
62 B 24ms
22ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 590315f00efc0c29-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295cc0a0800000c29f9886200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
816 B 68ms
36ms Script
text/html 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=6GWiI9r17NeTfbdkNod7lBzXYirSum~450~div-gpt-ad-1553475674669-0&psa=0&zone=450&id=15024977&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.43:80
AN-X-Request-Uuid: e2c5d5dc-a5b1-4c92-9407-b07f62f5be11
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
78 B 21ms
21ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 590315f00efd0c29-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295cc0a0800000c29f9887200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
817 B 69ms
34ms Script
text/html 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=5hdznJLA5YUz90LK0eeGW4T6iFqD7a~451~div-gpt-ad-1553475817787-0&psa=0&zone=451&id=15024978&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.113:80
AN-X-Request-Uuid: d9fa0824-e8ae-435f-bfd1-6266aec79a7f
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
61 B 28ms
28ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 590315f01f030c29-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295cc0a0a00000c29f9888200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
816 B 83ms
17ms Script
text/html 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=5pPNgn7db9lerOyJ63nbvdWMO279xy~452~div-gpt-ad-1553475909622-0&psa=0&zone=452&id=15024979&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.78:80
AN-X-Request-Uuid: c56f9524-fa45-4abc-9fb8-5a15f3bac0ea
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
61 B 21ms
20ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 590315f01f070c29-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295cc0a0a00000c29f9889200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
817 B 79ms
13ms Script
text/html 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=nUCegur2h8QdDRMdLJB0eqIkpNN7hf~453~div-gpt-ad-1553475988342-0&psa=0&zone=453&id=15024980&member_id=1908&size=728x90&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.111:80
AN-X-Request-Uuid: ec6bf5bc-e5e1-4216-870c-e767d18bab39
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
61 B 20ms
20ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 590315f01f080c29-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295cc0a0b00000c29f988a200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
817 B 91ms
23ms Script
text/html 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=erTxfxEaQcE2G6rvNT7fuktfbnFtqc~454~div-gpt-ad-1553476044183-0&psa=0&zone=454&id=15024981&member_id=1908&size=728x90&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
X-Proxy-Origin: 185.220.70.68; 185.220.70.68; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.241:80
AN-X-Request-Uuid: 35ed014e-728d-457d-bc28-1a2ddf4708f1
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/ 2 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/?random=1588939911706&cv=9&fst=1588939911706&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

499884442dfa831d601fd0c2a89ec800b8d722819dec571243704ad7c3134592

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1026
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/ 2 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/?random=1588939911709&cv=9&fst=1588939911709&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26346c2997866a8c254ac5a4cb46a7ae15911cb16ab50eab94ba0211cc72c9e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1026
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/802310072/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/?random=1588939911709&cv=9&fst=1588939911709&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

20ms
18ms

Image
image/gif

2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&is_vtc=1&random=2964737342&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/802310072/?random=1588939911709&cv=9&fst=1588939200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&is_vtc=1&random=2964737342&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2629 2 KB
1 KB 27ms
25ms Script
text/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: eba6f2bdbde062e0c8cc9e19f7263285c198e916d08c7b74e4a44dfdcca68ca8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2 200 247445556002302 Show response
connect.facebook.net/signals/config/ 475 KB
120 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/247445556002302?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

173bf971478c26c62d39568f01aba75e836f04fe65b35d755803382abea7e5f5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 122178
x-xss-protection: 0
pragma: public
x-fb-debug: 0ClyzVrb8eFtDhfdLBemHCUNy/oMc8oY4LLASDMJB9DtpLfkCWfjS13NSIdG7hT3SR97DQrmx6b50qFCJckPZg==
x-fb-trip-id: 1814657579
x-frame-options: DENY
date: Fri, 08 May 2020 12:11:51 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
368 B 65ms
64ms XHR
text/javascript 13.225.86.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsafehaven.com%2F&pid=88uufVoJ45OB3&cb=0&ws=1600x1200&v=7.49.02&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-BTF2%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-728x90-ATF%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-728x90-BTF%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
via: 1.1 edfd22ec6695cdc9d7ac634220af1315.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C2
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: vHXEXPQ8zOhsoa5lEWjmszvUgteOpxpmL9MZfmZXNSzngfOBSZO_cA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 22ms
8ms XHR
application/javascript 13.225.86.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 08:48:36 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 12196
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 09 Apr 2020 23:46:54 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 7O6pMMj-WsEQELSJjoUzg_mFMQNYVtT1Kov524xr7aEikpB9l3m6mg==

GET
H2 200 api.min.js Show response
a.optmstr.com/app/js/ 199 KB
60 KB 26ms
7ms Script
application/javascript 23.111.11.100
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optmstr.com/app/js/api.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.100 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c73e66343b58de4ecf1646d9910e95de94f4286795ce2a2c7ed7efacf6b60e63

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT
content-encoding: gzip
last-modified: Thu, 07 May 2020 16:20:16 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 65DEBD5B26C88727
etag: W/"cf7fac43ccd9b89b61eb4521fe60a5f7"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: bdgG3dfcxeqv0Y2ADJn1T9E5zTA5og2RiDqIWVTQw/swCsQYm1s2i3LeYAWPoiv/yLH7Ln/zpb4=
expires: Mon, 03 May 2021 12:11:51 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 1126ms
824ms Stylesheet
text/css 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 7050

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2629 19 KB
6 KB 22ms
19ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 15:01:36 GMT
Server: nginx
ETag: W/"5e441350-4be0"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 12:11:51 GMT

GET
H/1.1 200
OK DetectGDPR2.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2629 8 KB
3 KB 48ms
18ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 18:48:12 GMT
Server: nginx
ETag: W/"5e2ddeec-211f"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 12:11:51 GMT

GET
H/1.1 200
OK DetectGDPR.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2629 7 KB
3 KB 53ms
18ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 11:58:13 GMT
Server: nginx
ETag: W/"5e2d7ed5-1d87"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 12:11:51 GMT

GET
H/1.1 200
OK hls.0.12.4_1.min.js Show response
live.sekindo.com/content/video/hls/ Frame 2629 247 KB
85 KB 61ms
25ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Last-Modified: Mon, 06 Jan 2020 15:31:56 GMT
Server: nginx
ETag: W/"5e1352ec-3dcb9"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 12:11:51 GMT

GET
H/1.1 200
OK prebidVid.2.44.3_4.min.js Show response
live.sekindo.com/content/prebid/ Frame 2629 272 KB
101 KB 60ms
25ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 May 2020 09:21:08 GMT
Server: nginx
ETag: W/"5eafde84-4415a"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 12:11:51 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame 2629 413 KB
117 KB 86ms
50ms Script
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588939911&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: c5bb33dea6eb71553b0b763cc6b0703703a3f6971256eb920b94963e40d6c749

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Server: nginx
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 /
www.google.com/pagead/1p-user-list/814550776/ 42 B
110 B 19ms
18ms Image
image/gif 2a00:1450:4001:815::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/814550776/?random=1588939911706&cv=9&fst=1588939200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=1392637727&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/814550776/ 42 B
110 B 22ms
21ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/814550776/?random=1588939911706&cv=9&fst=1588939200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=1392637727&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/820290545/ 42 B
110 B 20ms
19ms Image
image/gif 2a00:1450:4001:815::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/820290545/?random=1588939911709&cv=9&fst=1588939200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=3876687437&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/820290545/ 42 B
110 B 20ms
20ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/820290545/?random=1588939911709&cv=9&fst=1588939200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=3876687437&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 651529765710614 Show response
connect.facebook.net/signals/config/ 475 KB
119 KB 15ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/651529765710614?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

370f89f6ebcec94f6a529911989dc8cd601a3cf2795b36cc3b5ba92fae8af47d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id: 1814657579
pragma: public
x-fb-debug: oiron88V2jsUHckHI+fumCF9ZrJv7TOlEZNYPzlnVaM2qWpW3st46tk2UPTYR7aEr4zJbNcpn8BLMwJ9R+KfHw==
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: DENY
date: Fri, 08 May 2020 12:11:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
status: 200
cache-control: public, max-age=1200
vary: Accept-Encoding
content-length: 122179
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
249 B 12ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=247445556002302&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1588939911953&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1588939911950.760817977&it=1588939911771&coo=false&rqm=GET

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:51 GMT, Fri, 08 May 2020 12:11:51 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Fri, 08 May 2020 12:11:51 GMT

GET
H2 200 20987 Show response
api.omappapi.com/v2/embed/ 82 KB
10 KB 149ms
113ms XHR
application/json 52.222.190.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/20987
Requested by: Host: a.optmstr.com
URL: https://a.optmstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.102 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-102.ham50.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 813628535187fe19c6e20047ec1987cb69c53a0fdc33b3bec28d2876a683a6d9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: HAM50-C2
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 1720
x-user-agent: standard
server: Pagely Gateway/1.5.1
vary: Accept-Encoding, User-Agent
content-type: application/json;charset=utf-8
via: 1.1 ee327b50c68ee28ed3c41a10d5a0b1d5.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account
access-control-allow-origin: *
x-amz-cf-id: zqjw_COKRmrc-dSa1o23VrCIB6xuLtTC8UmLvI1Rly3NM_0OKcBLAg==

GET
H2 200 /
www.facebook.com/tr/ 44 B
146 B 9ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=651529765710614&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1588939912013&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1588939911950.760817977&it=1588939911771&coo=false&rqm=GET

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT, Fri, 08 May 2020 12:11:52 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 2629 101 KB
26 KB 11ms
11ms Script
application/javascript 13.225.86.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 20:13:12 GMT
content-encoding: gzip
server: Server
age: 57519
etag: ad48a5f558eb50f381edaa87211f6c91
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 2M6cWoI3VZHjqV2niEYcDNnlZA7xel7BoAFDvjL6pQQ-rrS6sVMNZA==
via: 1.1 edfd22ec6695cdc9d7ac634220af1315.cloudfront.net (CloudFront)

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
16 KB 432ms
432ms XHR
text/plain 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1279424936209353&correlator=2004801282379699&output=ldjh&impl=fifs&adsid=NT&eid=21066107%2C21065393%2C21065783&vrg=2020050602&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200508&iu_parts=192633929%2Csafehaven-300x250-ATF%2Csafehaven-300x250-BTF%2Csafehaven-300x250-BTF2%2Csafehaven-728x90-ATF%2Csafehaven-728x90-BTF&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=300x250%2C300x250%2C300x250%2C728x90%2C728x90&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1588939912&dt=1588939912339&dlt=1588939910801&idt=659&frm=20&biw=1585&bih=1200&oid=3&adxs=1068%2C1068%2C240%2C241%2C429&adys=661%2C943%2C2198%2C1109%2C2874&adks=814543115%2C3046793618%2C190242331%2C1732354106%2C2965735416&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsafehaven.com%2F&dssz=56&icsg=2818572928&mso=32&std=41&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x532%7C320x532%7C395x250%7C824x90%7C1585x90&msz=320x250%7C320x250%7C395x250%7C824x90%7C1585x90&ga_vid=2139183475.1588939911&ga_sid=1588939912&ga_hid=1798720709&fws=0%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

5410bb2efa72fe5238e4d36cf1ab0f8a03408bc21b6349b58e6c0d1664b96453

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15928
x-xss-protection: 0
google-lineitem-id: -1,-1,5012542490,-1,5012261260
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,138265545085,-1,138265239347
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://safehaven.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
5ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.18/ 16 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 17:38:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1276381
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6490
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Apr 2021 17:38:51 GMT

GET
H2 200 mobile-detect.min.js Show response
cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/ 38 KB
15 KB 22ms
21ms Script
application/javascript 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/mobile-detect.min.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 7876436
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295cc0ce00000d72190a0a200000001
served-in-seconds: 0.002
timing-allow-origin: *
last-modified: Sat, 08 Sep 2018 10:00:50 GMT
server: cloudflare
etag: W/"5b939dd2-9624"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 590315f49f25d721-FRA
expires: Wed, 28 Apr 2021 12:11:52 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 2629 6 KB
3 KB 14ms
13ms XHR
application/javascript 13.225.86.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 08:48:36 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 12197
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 09 Apr 2020 23:46:54 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: Y2kFu_1KfRbkPxHEgvM7F_qBdUc-hTZjqixZxxNmRGI5DS98PkReLA==

GET
H2 200 css
fonts.googleapis.com/ Frame 06C6 2 KB
684 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 12:11:52 GMT
server: ESF
date: Fri, 08 May 2020 12:11:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0D80 2 KB
638 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 12:11:52 GMT
server: ESF
date: Fri, 08 May 2020 12:11:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H/1.1 200
OK user_sync.html
ads.pubmatic.com/AdServer/js/ Frame F7F2 0
0 52ms
14ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:28:34 GMT
ETag: "1300708-2eae-5a33da96f833f"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 4169
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=109122
Expires: Sat, 09 May 2020 18:30:34 GMT
Date: Fri, 08 May 2020 12:11:52 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 26ms
22ms Image
image/png 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:51 GMT
Last-Modified: Sun, 11 Jun 2017 08:03:58 GMT
Server: nginx
ETag: "593cf96e-5dbf"
Content-Type: image/png
Cache-Control: no-cache, private
Accept-Ranges: bytes
Content-Length: 23999
Expires: Fri, 08 May 2020 12:11:50 GMT

GET
H/1.1 200
OK logo_5146.png
video.sekindo.com/uploads/video/users/logo/19668/ Frame 06C6 18 KB
18 KB 292ms
260ms Image
image/png 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/video/users/logo/19668/logo_5146.png?cbuster=1563896491

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Tue, 23 Jul 2019 15:41:25 GMT
Server: Tengine
ETag: "5d372aa5-470b"
X-Cache-Status: MISS
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: max-age=604800, private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 18187
Expires: Fri, 15 May 2020 12:11:51 GMT

GET
H/1.1 200
OK vid5eb520d45c646066411871.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 12 KB
12 KB 44ms
10ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.jpg?cbuster=1588928725

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Fri, 08 May 2020 09:10:35 GMT
Server: Tengine
ETag: "5eb5220b-2fc7"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12231
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733289db1548301905.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 26 KB
26 KB 44ms
10ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733289db1548301905.jpg?cbuster=1588884276

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

5c8b3abfc048dad503e3e5a62c1518c4c0e933389e46f8339990b12c4deb9213

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:43:47 GMT
Server: Tengine
ETag: "5eb48113-6784"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 26500
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733ee9052239075304.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 9 KB
9 KB 44ms
10ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733ee9052239075304.jpg?cbuster=1588884290

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

39ac46b13bedb7f0fdf649e1b604d551d1070130f08b8bfe74583bde4cc4ebbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:46:59 GMT
Server: Tengine
ETag: "5eb481d3-224e"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 8782
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733d9afab339860429.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 22 KB
22 KB 45ms
11ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733d9afab339860429.jpg?cbuster=1588884286

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:46:03 GMT
Server: Tengine
ETag: "5eb4819b-5760"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 22368
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733c0dbdc216040941.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 9 KB
10 KB 45ms
8ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733c0dbdc216040941.jpg?cbuster=1588884285

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

d72afc407a3d6289f8150ea724ffd9ef215084236cfb6c831a3d91f136cda7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:45:50 GMT
Server: Tengine
ETag: "5eb4818e-2595"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 9621
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733abe02e232097995.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 22 KB
22 KB 11ms
9ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733abe02e232097995.jpg?cbuster=1588884283

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:45:23 GMT
Server: Tengine
ETag: "5eb48173-5760"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 22368
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47338c1907736866527.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 20 KB
20 KB 10ms
9ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47338c1907736866527.jpg?cbuster=1588884282

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

856ebd974805a315c6419b50ff68e30ca94f384415d85af8c56cbb5479f3faa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:45:09 GMT
Server: Tengine
ETag: "5eb48165-4f50"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 20304
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47337a1a7a278668266.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 10 KB
10 KB 8ms
8ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47337a1a7a278668266.jpg?cbuster=1588884280

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

2e14464924e0301cda997640b9918eb65cca0c896a4610e0b35101975b013adf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:44:51 GMT
Server: Tengine
ETag: "5eb48153-2762"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 10082
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47335316e8519280491.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 13 KB
13 KB 9ms
8ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47335316e8519280491.jpg?cbuster=1588884279

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

4477dd6cbad78ef9acc3c17095843a20dd110fe9adccea64a6db0b87086fdd81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:44:37 GMT
Server: Tengine
ETag: "5eb48145-340d"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13325
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733466ad8584484743.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 0D80 23 KB
24 KB 11ms
10ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733466ad8584484743.jpg?cbuster=1588884276

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

f43d2cf395827366eb0b0ae06b9cc2446cd50b8cb198ad918bd550591c9e9571

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Thu, 07 May 2020 21:43:52 GMT
Server: Tengine
ETag: "5eb48118-5d81"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 23937
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 2629
Redirect Chain

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent=

43 B
378 B

13ms
11ms

Image
image/gif

54.93.38.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.38.91 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-38-91.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 08 May 2020 12:11:52 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Fri, 08 May 2020 12:11:52 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54c87b4630&custom_data=5eb54c87b4630&gdpr=1&gdpr_consent=
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 2629
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=6ccdde4d-ba96-42a8-9aac-c154e7e3e51e

0
347 B

31ms
30ms

Image
text/html

185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=6ccdde4d-ba96-42a8-9aac-c154e7e3e51e
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:52 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: no-store
Content-Type: text/html; charset=utf-8

Redirect headers

status: 307
date: Fri, 08 May 2020 12:11:52 GMT
content-length: 0
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=6ccdde4d-ba96-42a8-9aac-c154e7e3e51e

GET
H/1.1 200
OK vid5eb520d45c646066411871.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 06C6 12 KB
12 KB 29ms
7ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.jpg?cbuster=1588928725

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://amli.sekindo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Fri, 08 May 2020 09:10:35 GMT
Server: Tengine
ETag: "5eb5220b-2fc7"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12231
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ Frame 06C6 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 06C6 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 /
www.facebook.com/tr/ 0
80 B 17ms
14ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxSfaaqxKPd0g2ViS

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 08 May 2020 12:11:52 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2629 17 KB
2 KB 49ms
48ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=396&y=223&fpl=1&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.10490036010742&geoLong=8.629500389099121&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&cbuster=1588939912522&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 7bb3838ecccba1c744cc76c0b19d009f7b9419d74222a22708142e9edb5ec2be

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1699

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2629 17 KB
2 KB 43ms
42ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=350&y=197&fpl=1&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.10490036010742&geoLong=8.629500389099121&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&cbuster=1588939912522&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: ea25fc73e8b4a069e9c53b400146670ddc822371778baaffdab439765d66aaf5

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:51 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1698

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2629 2 B
429 B 42ms
41ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=396&y=223&fpl=1&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.10490036010742&geoLong=8.629500389099121&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&cbuster=1588939912523&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:52 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 22

POST
H2 200 /
www.facebook.com/tr/ 0
29 B 12ms
12ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygJYj5L8aicYBt2Zh

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 08 May 2020 12:11:52 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2629 2 B
429 B 56ms
55ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=350&y=197&fpl=1&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.10490036010742&geoLong=8.629500389099121&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&cbuster=1588939912650&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31357D7B7331313031303933367D7B4335377D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54c87b4630&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.10490036010742&geoLong=8.629500389099121&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:52 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 22

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 2629 185 B
386 B 39ms
21ms XHR
application/json 52.57.217.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.217.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-217-231.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c99edecede037e1dd887b6abed9749bd6733cbabdc43c3b81016de6ad5b81272

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://safehaven.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

GET
H/1.1 200
OK chunklist_640.m3u8 Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 2 KB
3 KB 36ms
8ms XHR
application/vnd.apple.mpegurl 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/chunklist_640.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 064e739a77f7623ba98eb109804d6d70d0773ee7be25f8a7d72e580fff406aa4

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Fri, 08 May 2020 09:12:29 GMT
Server: Tengine
ETag: "5eb5227d-8cc"
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:09 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 2252
X-Proxy-Cache: HIT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 06C6 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
Origin: https://safehaven.com

Response headers

date: Tue, 14 Apr 2020 23:26:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 2033093
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 14 Apr 2021 23:26:59 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 2629 0
214 B 248ms
201ms XHR
application/json 35.158.16.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.16.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-16-38.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://safehaven.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 2629 0
1 KB 114ms
74ms XHR
application/json 185.86.138.79
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.79 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:52 GMT
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://safehaven.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-type: application/json
content-length: 0
expires: -1

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 43 B
463 B 21ms
20ms Image
image/gif 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1588939912&s=58057&sta=11623857&x=350&y=197&msta=11010936&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&playbackMethod=auto&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&playerVer=3.0.0&cbuster=1588939912727&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:52 GMT
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000
Content-Disposition: inline; filename="pixel.gif"
Content-Type: image/gif
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK w_640_000.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 314 KB
315 KB 10ms
10ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 4af00ba1a8bb2dd1374c5d434a9e0869343c8ea57922fdae7a53df4cf8bf40e4

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:09 GMT
Last-Modified: Fri, 08 May 2020 09:12:04 GMT
Server: Tengine
ETag: "5eb52264-4e9fc"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:09 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 322044
X-Proxy-Cache: HIT

GET
BLOB 200
OK 884c02b5-beaf-4314-a57d-fc219cecabec
https://safehaven.com/ Frame 2629 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://safehaven.com/884c02b5-beaf-4314-a57d-fc219cecabec
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 6FFF 0
0 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Fri, 08 May 2020 11:14:09 GMT
expires: Sat, 08 May 2021 11:14:09 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3463
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame DE6D 0
0 7ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Fri, 08 May 2020 11:14:09 GMT
expires: Sat, 08 May 2021 11:14:09 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3463
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame 4E52 95 KB
40 KB 17ms
14ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:04:46 GMT
content-encoding: gzip
age: 47227
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Oo3O0UHt8Q5vEh3m1M1fGhH8ITlRz1ymcnVPydeuA0WIiaAVV1ULyA==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame 4E52 36 KB
13 KB 16ms
13ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 16:40:46 GMT
content-encoding: gzip
age: 761467
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: AfjywmbscyMZ-mXCIMF1m7E8zDOnpefjHKJBVLdybhwm6NS5_ROAGg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4E52 107 KB
38 KB 27ms
23ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4E52 74 KB
28 KB 19ms
16ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame A343 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Fri, 08 May 2020 11:14:09 GMT
expires: Sat, 08 May 2021 11:14:09 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 3463
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame EB26 95 KB
40 KB 19ms
15ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:04:46 GMT
content-encoding: gzip
age: 47227
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: UCdAArOHYo3vf-ZR9VUsmUVb4RWJog2qlSIgKYHc2a4kHqQHxKbA5w==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame EB26 36 KB
13 KB 20ms
17ms Script
application/javascript 52.222.190.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.190.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-30.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 16:40:46 GMT
content-encoding: gzip
age: 761467
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ErZACCQgigB0v8ICDuSes0cMYXQYUIjGTPSfLimKbGHwOqmikp83WA==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame EB26 107 KB
38 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame EB26 74 KB
28 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:52 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4E52 0
0 43ms
43ms Fetch
image/gif 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxhWoH20PKMB5wXXH5k0oPV4z3GqCf3m9T-922jKYNyAuHa8TXBg-fl_f0ch9QXcamxwjEVX34W8-NuSsgPIp-oZIvZ5R-VpqP4KxhU4dVbLx_ZteOj9lc0ABoV5nf7e4BZ4qdYR5aoGNirxeVtjjXaD3ZjL0VUJnJ3tbZwJxduylTYIgaoJdSfcnmvjI8iC7rqKkAlnD9yTfImn9WRGr2EKP0Pl5zfsS9xnCYfl4EVcjqpOdFB2uDRouM43LIuX-Pq9cMREL6YG33JSI_P3ga&sig=Cg0ArKJSzPvQ746KqBHGEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:52 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4E52 0
62 B 78ms
77ms Image
image/gif 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsubUjfZM0jeTHYJgJHNiA3NmiXvTmoPtQXFgEzHT7nnkHXpFndIaoEoArBQuexwBy41D6hUseg6CUjAHPcoFcsZWXH9sASu6qk9do6D2KmEs1wdt-Cz_9zTDtG_7gsMEFDNxdYdzqwr5Lg6TXuZn8LTTmOquTO73Z_W9BoIj_dsOPYti7XA54RRmKlGj0c0sUW8BHqXRcYo4UVG-Y3Gi8M-nEi6naSQaO1kTL-8pRwRjqNGgI2KssoDyaOvTuvldyWz9-pTPaK7bLlqztdiMwZUfzk&sig=Cg0ArKJSzJ2u2z-Rn653EAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:52 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4E52 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6183c3c5d8c6ae96da5bff3aa17f1283a1340bf0c748a89f29890fe63ce5389b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ 5 KB
796 B 19ms
17ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600,400

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

76c828df931848541d008f5df340db07e1fd29788cd50f9f86198c9c452fdc9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 12:11:53 GMT
server: ESF
date: Fri, 08 May 2020 12:11:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
7 KB 21ms
19ms Stylesheet
text/css 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2901853
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295cc0f230000d72190a2c200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: W/"5afd4939-9226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 590315f838a8d721-FRA
expires: Wed, 28 Apr 2021 12:11:53 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 4E52 109 B
171 B 14ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4E52 109 B
171 B 46ms
46ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame 4E52 217 KB
82 KB 44ms
42ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/ Frame 8A6D 0
0 8ms
5ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200506/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-HWloNxlbuvhYNFfJdbLfw7VwlPrexvvypVIEeFGZp1-1ah4fxooKg1Kw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 07 May 2020 02:45:36 GMT
expires: Thu, 21 May 2020 02:45:36 GMT
content-type: text/html; charset=UTF-8
etag: 4094386822458569044
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4444
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 120377
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame EB26 0
0 65ms
65ms Fetch
image/gif 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsszWPDH6aDxCuEiyTp8mJrQdmO92v6j70zaKSintZmWEZ4nIRylMST60Low7Woip8N0qybJSeVhe3AHZvQTebn1RjMVUqyjFK4B9C1FkUhaR70AZM0AHQbWm03ffk9cuVONtKh10WHfAmXI-aMgA0oQ-VQVFZ_zblWeEyvZaD0IkNjM-qCQi0TCnmtzNwxvabX1BDQx59KxiNbx2Q9gzFVpV3sVF02JCDQkvMyvbDbPBR-VgQQHr54iqOby7WF8F3BocdXDc_hHQnkzzNDlLQ&sig=Cg0ArKJSzH1-rLHzlCuNEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame EB26 0
62 B 59ms
57ms Image
image/gif 172.217.22.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstYsLb5QnYc-Inrn2jGRHmRaLBxdwhnBl0LNEEOqktg-rLk-0TyN8aZzFIEA7WNalleimtjegJI60-hJ_JRMKumOojF0rW8cCTiMRftc3tvwradBWA2rC1ajhNJq8gSOTUiANcB1anuqSf1eqJYqV2GX0V9i5DiaYKm8csIzxaj_4w9IiRyIvcmQaTuOI1H4nAdSzGgYylyzZjOPD9zEu0r-8C0FsytQItTvmZZlIlonRBNnk5loz8YD7XnLUMm4hFbuj28DbM2JMWVYAHhr3gr&sig=Cg0ArKJSzABknuQKHZhYEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EB26 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50d2f618884e567744c75aa3376686433697a4dac4b66f720c2bb0f206ca0da1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:600,400
Origin: https://safehaven.com

Response headers

date: Wed, 15 Apr 2020 23:49:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 1945329
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Thu, 15 Apr 2021 23:49:44 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:600,400
Origin: https://safehaven.com

Response headers

date: Fri, 03 Apr 2020 05:34:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:44 GMT
server: sffe
age: 3047828
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Sat, 03 Apr 2021 05:34:45 GMT

GET
H2 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 75 KB
76 KB 12ms
11ms Font
application/octet-stream 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Origin: https://safehaven.com

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 8602088
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 77160
cf-request-id: 0295cc0ff80000175ef61aa200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: "5afd4939-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 590315f98dd0175e-FRA
expires: Wed, 28 Apr 2021 12:11:53 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame EB26 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame EB26 109 B
171 B 14ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame EB26 217 KB
82 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame C33C 0
0 251ms
250ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913005&bpp=50&bdt=165&idt=397&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=2&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=2012639787&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1231482199072854&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.ddn6btt8lknv&btvi=1&fsb=1&dtd=410

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913005&bpp=50&bdt=165&idt=397&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=2&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=2012639787&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1231482199072854&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.ddn6btt8lknv&btvi=1&fsb=1&dtd=410
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-HWloNxlbuvhYNFfJdbLfw7VwlPrexvvypVIEeFGZp1-1ah4fxooKg1Kw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 12:11:53 GMT
server: cafe
content-length: 19211
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4E52 73 KB
27 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H/1.1 200
OK w_640_001.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 333 KB
333 KB 11ms
10ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 9dcdc83bf21b50a7a30e8628dc033e2505b134c8cd0dcf24823aed6534669d12

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:10 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-5336c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:10 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 340844
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 0
379 B 21ms
20ms Image
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1588939911&s=0&sta=11010936&x=350&y=197&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&contentFileId=788378&mediaPlayListId=4637&playerVer=3.0.0&contentMatchType=&isExcludeFromOpt=0&cbuster=1588939913450&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:53 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 0EBC 0
0 227ms
227ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913282&bpp=2&bdt=424&idt=193&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=1&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=234728736&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085%2C21062175&oid=3&pvsid=1642985913830761&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.qv7wqv7l662u&btvi=1&fsb=1&dtd=197

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588939913282&bpp=2&bdt=424&idt=193&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=4993235341879&frm=23&ife=4&pv=1&ga_vid=2139183475.1588939911&ga_sid=1588939913&ga_hid=234728736&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085%2C21062175&oid=3&pvsid=1642985913830761&pem=601&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.qv7wqv7l662u&btvi=1&fsb=1&dtd=197
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-HWloNxlbuvhYNFfJdbLfw7VwlPrexvvypVIEeFGZp1-1ah4fxooKg1Kw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 12:11:53 GMT
server: cafe
content-length: 19396
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame EB26 73 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H/1.1 200
OK w_640_002.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 317 KB
317 KB 8ms
7ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 761a8324e7e7cc5c30715cd8d5139110fe53182a94166456e6e5c121044cc1c5

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:10 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-4f210"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:10 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 324112
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_003.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 360 KB
361 KB 8ms
8ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: d4f8f618b5ea26d134f3a21ea4d754f43ee936d8517133b80dcb6e7dea6d618b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:10 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-5a0d8"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:10 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 368856
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_004.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 351 KB
352 KB 9ms
8ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 0bffe3a273c7f7839ba27081fcf7b2f241db645c7e93f20a1260b89eee76ac00

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:10 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-57d98"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:10 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 359832
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_005.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 337 KB
338 KB 9ms
9ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: eae511396b0f23a63d0595139d59e1859ba49c47dbe160bd56a8f055e4ed8acf

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:10 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-5450c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:10 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 345356
X-Proxy-Cache: HIT

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame D2D3 0
0 37ms
7ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rsid=1|AIfsdBUH+v3fWCPuzNowDE/csJlhLqCtjDNRTpP3Ow53wYWQO2qPRMedY77lho/RRR2s2jWpYWaqeROXM3r9QV20o10JuQw19gMkasvdREJwzG6oEKdWU6zjS6W3MjDFVf/xlH9h; ses2=; vis2=250874^1; ses15=; vis15=250874^1; khaos=K9Y5SQE3-28-EPVV; audit=1|hLZGFuTafB290Cd66DrAp/vNZcUr9GqcbAFACsALu4+3tN778UggJVkOObAAcfYbaNgdOVL2Yy8UFclmyCcIGrKpUjWTmmg0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 23 Apr 2020 20:31:59 GMT
Content-Encoding: gzip
Content-Length: 9125
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=35178
Expires: Fri, 08 May 2020 21:58:11 GMT
Date: Fri, 08 May 2020 12:11:53 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 2629
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46&verify=true

0
977 B

11ms
10ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46&verify=true

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:53 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Fri, 08 May 2020 12:11:53 GMT
Server: ATS/7.1.2.106
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEVIiVQFsACBb0WIx_TQA_U&google_cver=1&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46&verify=true
Connection: keep-alive
Content-Length: 0

GET

sync
sync.adap.tv/ Frame 2629
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XrVMiQAAAFxK0goD
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVMiQAAAFxK0goD&_test=XrVMiQAAAFxK0goD

0
0

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 2629 43 B
794 B 129ms
43ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55953/ Frame 2629
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852
https://ups.analytics.yahoo.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&apid=1A199b31b8-9125-11ea...

0
989 B

14ms
13ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:53 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 08 May 2020 12:11:53 GMT
location: https://ups.analytics.yahoo.com/ups/55953/sync?uid=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=ab3d22ca-bd18-4cad-a6cb-f2b4a0859852&apid=1A199b31b8-9125-11ea-b7fb-12998b4eae46
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4E52 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c09ec216d284cea1057b80f248d2e327376d04911cbedcfdafae58c79429ee7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5507
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4E52 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame CB30 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:14:12 GMT
expires: Sat, 08 May 2021 11:14:12 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3461
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame EB26 7 KB
6 KB 18ms
17ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7deac7d749291f91aab0cb044b662cc3fcad6c7a7da56554d1ce144771e6d253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5576
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020050602&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020050602.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35048607b21ee536902bdf863001c06a70dfe10e68f8970ff8e6d8d2c8001865

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5533
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame EB26 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 12:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 12:11:53 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 4A6E 0
0 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:14:12 GMT
expires: Sat, 08 May 2021 11:14:12 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3461
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 72BE 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:14:12 GMT
expires: Sat, 08 May 2021 11:14:12 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3461
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4E52 0
69 B 40ms
39ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=1231482199072854&bg=!BQalBh5YS3mnw8CTxfMCAAAAZ1IAAAAamQF7KeXkFwftohl6-js1Jx65LNFGruzpctnoXj1cG7sYtck2jIYx2JQqUhA3XMF-d8uaUnoWdN7ciR96WtCGmC9waAHUKT9toUhGukaVkpp9qAH-HLKqjYWQmICds6yuqB-6sG-rQqt0ATGNVSbB6XMSxq6OWTGb4SBy_ld44bDgbv1dDQjsxMJ7tqeLR5NlJZd5tExNo4d1jjH1USqOOUPabJe42wL6eDdjBzI5HWMXMukAMoJxmUUtFPz8dbewhjFtphMcJDWIIV458b1vC2RS_U2xf1ffexmurrpJNi9NW9lSsGpLRr9YRrcfnouIakQYvt3_y_6GfDoT-0JNgnZJ_gxPe3PK99Rp--5jAKj02vl-6Ja3o6-nz7fnPBZPXQEj1LjvKqtVrjVpYzy3tJvMwf_czU6FL4-lv2eaFwMdc42UJNa77oDy9ZM8F7VIh5vGhkTuTxWyQiBB3El4fl147S9qcDAwwLrabDVv37Dh5CfDL51e7cUL-b8I5Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EB26 0
69 B 39ms
38ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=1642985913830761&bg=!Hh2lHQVY8_23cgdblSgCAAAAXVIAAAAamQF74duucicCMKiiOYgTQC9fl1eUshPlCYY2KWkhr--0mN8hWOaKy-KzIOwzTpBm25N_o_qryhABBz958jM4DmF5jefQOQtMsJYm0XIj2eGOQe0TDKiY3gKyZ_kgCeXyj45jQevDOmnvXKmfl0aRXISA5koHaMMdX4PZ1_6snmEmElGII_JUPo3VcOQ6TFzrGXDi0GiusccMDFR_-xROaOC3uRMPeC8fXcCw31Ll7e-FmGiRWQ_jWoBSubLnTu1d9gKa7z9N0q0laWgH8pGkIeBprIroWfx6LpOV_mDs8xYmGxJ8y1v0ogusTpU6_vn1OFPPjI7gZjqeeKt3Dact8Lfu_VR3eeeAK5M86h0Yfw-uYESpwg4a6szHV0oh8S0oZRvIdyUcUrFk22KRCL3L-l5E5G4Gn3rxFS1Fqf4q4_6pw8Di3lcH6WHSi5cMo53y47QENXvVg20vs8_0z--NUU7-z27QSmvwPw1PNKtNRHjyQmPU41GD2fFb7O1c7g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
69 B 40ms
38ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020050602&jk=1279424936209353&bg=!ISKlIjpYdwxMn_bJKzUCAAAAWlIAAAASmQF1I3sF0Yvn6mdSGf1UoG-N2vvBAb01B1k3d_IOLDHx7GpqeV0nGhpS96elaRFsqjhu8uZiAn77IqDlVYZOtEUtcnZ7tfxdS1HZsd_-XHNNKWWNyX3ZcOyfZuR26ZHUrTiwi1bsZ_d_9mBsUj2dBQEzlOifnGYD_k2Hlj3mvbdIebie0hL9mK9QyOteWsEyn_UkO1mAmhAOu4aVIHWWPin4yUT6i1j3Q-wCKbmFZhKkzJCOozAxjOjL4uyDPiMb9y5hnBrT9jzJERWIAr3UtC22Ezzapfrs9UfZaDgcj8S6L7Ld6LxcZPfgQLkFFEGiqLrFPabT0NbOav9cp9Lwtu2vNLOiLkcsxBMzbVhTeA3egUDSQUaVBL6HuVzKLtE5UtQc0NK3Az2Qsl9nW829RxJ0hqGZDi2mFXoz5uxRVjAPj8nA7SpdrjJtkNxpjj0BskYN4O8nQT2aAGcqgxtxH6R95PZYrzXorMYRT2Q5CX0Zk54KLyXFzw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 0
379 B 22ms
22ms Image
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1588939911&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&contentFileId=0&mediaPlayListId=0&cbuster=1588939914719&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:54 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 231C 0
0 48ms
15ms Document
text/html 72.247.225.17
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.17 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-17.deploy.static.akamaitechnologies.com
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: W/"573e714d-3e3"
Server: nginx/1.9.13
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Sat, 08 May 2021 12:11:55 GMT
Date: Fri, 08 May 2020 12:11:55 GMT
Connection: keep-alive

GET
H2

200

pd
eu-u.openx.net/w/1.0/ Frame F574
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1

0
0

19ms
18ms

Document
text/html

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.185.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=3e72f8ff-a4f1-0e3c-28bd-984d9aeb3592|1588939915
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=3e72f8ff-a4f1-0e3c-28bd-984d9aeb3592|1588939915; Version=1; Expires=Sat, 08-May-2021 12:11:55 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1588939915|mOgikimWiygu; Version=1; Expires=Sat, 23-May-2020 12:11:55 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.185.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 08 May 2020 12:11:55 GMT
content-type: text/html
content-length: 373
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=3e72f8ff-a4f1-0e3c-28bd-984d9aeb3592|1588939915; Version=1; Expires=Sat, 08-May-2021 12:11:55 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.185.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
date: Fri, 08 May 2020 12:11:55 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame E1DB 0
0 9ms
8ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 23 Apr 2020 20:31:59 GMT
Content-Encoding: gzip
Content-Length: 9125
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=35176
Expires: Fri, 08 May 2020 21:58:11 GMT
Date: Fri, 08 May 2020 12:11:55 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

Cookie set beacon
ap.lijit.com/ Frame FAF6
Redirect Chain

https://ap.lijit.com/beacon?informer=13394437
https://ap.lijit.com/beacon?informer=13394437&dnr=1

0
0

20ms
19ms

Document
text/html

216.52.2.30
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Host: ap.lijit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ljt_reader=398385289f491c974c4c7cce
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Server: nginx
Date: Fri, 08 May 2020 12:11:55 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Set-Cookie: ljtrtbexp=eJxljzkSwCAMA%2F9CnQLfdr6Wyd8zQGWlXDxapGfQuMmyJruQXYMX1iQtW%2BjeWToGdaYJdz92U419B31Vxe8lwQkVEv5IcCZ0TAU2YPAz5PlsyEqhzdE3CeQV%2Bij4tDob5K3tfz%2F6L1H4;Path=/;Domain=.lijit.com;Expires=Sat, 08-May-2021 12:11:55 GMT;Max-Age=31536000;Secure;SameSite=None ljt_reader=398385289f491c974c4c7cce;Path=/;Domain=.lijit.com;Expires=Sat, 08-May-2021 12:11:55 GMT;Max-Age=31536000;Secure;SameSite=None
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap6ams1

Redirect headers

Server: nginx
Date: Fri, 08 May 2020 12:11:55 GMT
Content-Length: 0
Set-Cookie: ljt_reader=398385289f491c974c4c7cce;Path=/;Domain=.lijit.com;Expires=Sat, 08-May-2021 12:11:55 GMT;Max-Age=31536000;Secure;SameSite=None
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon?informer=13394437&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap6ams1

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 7EC0
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

1074ms
17ms

Document
text/html

205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Date: Fri, 08 May 2020 12:11:56 GMT
Connection: Keep-Alive
Cache-Control: max-age=30881
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx0000000000000175761a8-005eb473ad-351f149-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1588939916.dop006.pa1.t,1588939916.cds025.pa1.shn,1588939916.dop006.pa1.t,1588939916.cds030.pa1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 1415 0
0 17ms
16ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:27:52 GMT
ETag: "13006b6-a4bb-5a33da6f1a023"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15243
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=114293
Expires: Sat, 09 May 2020 19:56:48 GMT
Date: Fri, 08 May 2020 12:11:55 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=60nPd-pPlSDzGplx6B-Acu0UlSHzHsxx6hwSpL8k

0
124 B

7ms
7ms

Image
text/plain

35.158.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=60nPd-pPlSDzGplx6B-Acu0UlSHzHsxx6hwSpL8k

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.158.17.58 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-158-17-58.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Fri, 08 May 2020 12:11:55 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:55 GMT
Server: QS
Strict-Transport-Security: max-age=86400
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=60nPd-pPlSDzGplx6B-Acu0UlSHzHsxx6hwSpL8k
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 30ms
29ms Image
image/gif 63.32.144.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.32.144.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-32-144-14.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 12:11:55 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 92ms
62ms Image
text/plain 2a02:fa8:8806:13::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A199b31b8-9125-11ea-b7fb-12998b4eae46&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 08 May 2020 12:11:55 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 9ms
8ms Image
text/plain 35.158.17.58
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.158.17.58 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-158-17-58.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Fri, 08 May 2020 12:11:55 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 0
379 B 23ms
22ms Image
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1588939911&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1588939917693&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:11:57 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_006.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 339 KB
340 KB 10ms
10ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 1cab0468a17863ff221f656527f6fa55d6d9190ab05f27d6603e082fae16bb50

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:16 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-54d20"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:16 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 347424
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 0
379 B 25ms
24ms Image
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1588939911&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1588939922476&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:12:01 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame 0D80 0
379 B 23ms
23ms Image
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1588939911&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=185.220.70.68&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54c87b4630&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1588939922693&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 12:12:01 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_007.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2629 344 KB
345 KB 14ms
13ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 68a006112d2811872b3b6b47e68c378280700a45c61bb3951deb632044b61f4f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 12:11:22 GMT
Last-Modified: Fri, 08 May 2020 09:12:07 GMT
Server: Tengine
ETag: "5eb52267-560f4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 12:11:22 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 352500
X-Proxy-Cache: HIT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.adap.tv
URL: https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVMiQAAAFxK0goD&_test=XrVMiQAAAFxK0goD

Verdicts & Comments Add Verdict or Comment

215 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 09:22:23	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 18:43:55	Name: IDE Value: AHWqTUl-HWloNxlbuvhYNFfJdbLfw7VwlPrexvvypVIEeFGZp1-1ah4fxooKg1Kw
.rubiconproject.com/	1970-01-19 09:23:23	Name: vis2 Value: 250874^1
eus.rubiconproject.com/	1970-01-19 11:31:55	Name: pux Value: 1512%3D90733%262231%3D90733%262249%3D90733%262974%3D90733%263778%3D90733%26idl%3D90733%26brx%3D90733%26goog%3D90733%26
.rubiconproject.com/	1970-01-19 09:23:23	Name: ses2 Value:
.rubiconproject.com/	1970-01-19 18:07:55	Name: audit Value: 1\|hLZGFuTafB290Cd66DrAp/vNZcUr9GqcbAFACsALu4+3tN778UggJVkOObAAcfYbaNgdOVL2Yy8UFclmyCcIGrKpUjWTmmg0
.rubiconproject.com/	1969-12-31 23:59:59	Name: rsid Value: 1\|AIfsdBUH+v3fWCPuzNowDE/csJlhLqCtjDNRTpP3Ow53wYWQO2qPRMedY77lho/RRR2s2jWpYWaqeROXM3r9QV20o10JuQw19gMkasvdREJwzG6oEKdWU6zjS6W3MjDFVf/xlH9h
.safehaven.com/	1970-01-20 02:53:31	Name: __gads Value: ID=c8597246a2fe1f54:T=1588939912:S=ALNI_MaNLnAMAXBAr8WYzdhoe88PBDILTQ
safehaven.com/	1970-01-19 09:22:20	Name: _omappvs Value: 1588939911986
safehaven.com/	1970-01-23 09:20:53	Name: _omappvp Value: nlmZnXVY6om1tMyXdYOS0vnfUjdeM4E9pnN50qfV6w6X9Cs0tdIhX2RDYuSNrVRPjB2767YLrS89anJHyw9mvKU1lDiWcsow
.pubmatic.com/	1970-01-19 11:31:55	Name: KTPCACOOKIE Value: YES
.rubiconproject.com/	1970-01-19 09:23:23	Name: ses15 Value:
safehaven.com/	1970-01-19 09:32:24	Name: AWSALB Value: ugTVFEDq1ONNZhZHz25AAK62MyqNzFbanz8CR+vah6FToKyfawTiVGU0CY1AB7IXLgfrKUAs+T8M4rbt6hU7ZLpjRWnWiz0YTRGbaXnkBVLPyE4FnjzywyYwm5ng
safehaven.com/	1969-12-31 23:59:59	Name: dmxRegion Value: false
.rubiconproject.com/	1970-01-19 18:07:55	Name: khaos Value: K9Y5SQE3-28-EPVV
.safehaven.com/	1970-01-19 09:22:19	Name: _gat_gtag_UA_2249023_27 Value: 1
.ads.pubmatic.com/	1970-01-19 09:23:46	Name: KCCH Value: YES
safehaven.com/	1970-01-19 09:22:27	Name: csrf_safehaven_cookie Value: c476e6edc55ce3b23ed7175c17b9bf8a
.safehaven.com/	1970-01-20 02:53:31	Name: _ga Value: GA1.2.2139183475.1588939911
safehaven.com/	1970-01-29 09:22:19	Name: _wingify_pc_uuid Value: 1b1a90adbf084350866dd2dd4b018379
.pubmatic.com/	1970-01-19 09:23:46	Name: pi Value: 159196:2
.rubiconproject.com/	1970-01-19 09:23:23	Name: vis15 Value: 250874^1
.safehaven.com/	1970-01-19 09:23:46	Name: _gid Value: GA1.2.2008974282.1588939911
safehaven.com/	1969-12-31 23:59:59	Name: safehaven_ci Value: c49f2a853a66b771fd6f9811b5194d3d4d1daa5a
safehaven.com/	1970-01-19 09:32:24	Name: AWSALBCORS Value: ugTVFEDq1ONNZhZHz25AAK62MyqNzFbanz8CR+vah6FToKyfawTiVGU0CY1AB7IXLgfrKUAs+T8M4rbt6hU7ZLpjRWnWiz0YTRGbaXnkBVLPyE4FnjzywyYwm5ng
.safehaven.com/	1970-01-19 11:31:55	Name: _fbp Value: fb.1.1588939911950.760817977

24 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-ATF div-gpt-ad-1553475674669-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-BTF div-gpt-ad-1553475817787-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-BTF2 div-gpt-ad-1553475909622-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-728x90-ATF div-gpt-ad-1553475988342-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-728x90-BTF div-gpt-ad-1553476044183-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/cmp.js(Line 3) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/cmp.js(Line 3) Message: GDPR is not applicable, skipping initialization of CMP
console-api	log	(Line 3) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	(Line 3) Message: Initial Ad Load
console-api	log	(Line 3) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	(Line 3) Message: Amazon bids returned, count=5
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: pbjs bids returned
console-api	log	(Line 3) Message: gPBJSTimeoutTimer cleared
console-api	log	(Line 3) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	(Line 3) Message: sendAdserverRequest()
console-api	log	(Line 3) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: pbjs.getBidResponses:
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: gThisRefreshSlots=
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	(Line 3) Message: console.groupEnd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optmstr.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
aol-match.dotomi.com
ap.lijit.com
api.omappapi.com
c.amazon-adsystem.com
cdn.districtm.ca
cdn.districtm.io
cdn.pushcrew.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
csync.loopme.me
d1o9e4un86hhpc.cloudfront.net
d2p6ty67371ecn.cloudfront.net
d2t794khe5w43b.cloudfront.net
d32r1sh890xpii.cloudfront.net
dmx.districtm.io
e.serverbid.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
ib.adnxs.com
live.sekindo.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
prg.smartadserver.com
qd.admetricspro.com
safehaven.com
safehaven.com.admin-us2.cas.ms
secure.adnxs.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
stats.g.doubleclick.net
sync.adap.tv
sync.serverbid.com
tagan.adlightning.com
teachingaids-d.openx.net
tpc.googlesyndication.com
ups.analytics.yahoo.com
video.sekindo.com
web.hb.ad.cpe.dotomi.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
sync.adap.tv
104.109.78.125
104.16.68.69
13.225.86.250
134.209.131.220
167.172.1.14
172.217.16.162
172.217.22.34
172.217.22.98
178.63.78.76
185.220.205.220
185.33.221.53
185.64.189.112
185.86.138.79
2001:4de0:ac19::1:b:1b
205.185.216.10
216.52.2.30
23.111.11.100
2600:9000:2070:4200:3:442:6dc0:21
2600:9000:2093:9400:17:eca0:da80:21
2600:9000:20eb:6800:10:4f52:7800:21
2600:9000:21f3:b400:c:5250:79c0:21
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:10::6814:3677
2606:4700:3037::6812:2030
2606:4700::6810:85e5
2606:4700::6812:633c
2a00:1288:110:c305::8000
2a00:1450:4001:801::2001
2a00:1450:4001:809::2002
2a00:1450:4001:814::2003
2a00:1450:4001:814::200a
2a00:1450:4001:815::2004
2a00:1450:4001:817::200a
2a00:1450:4001:81b::200e
2a00:1450:4001:824::2008
2a00:1450:4001:825::2003
2a00:1450:400c:c08::9c
2a02:fa8:8806:13::1430
2a02:fa8:8806:16::1460
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.126.56.137
34.95.120.147
35.158.16.38
35.158.17.58
51.137.137.121
52.222.190.102
52.222.190.30
52.43.18.65
52.57.217.231
54.93.38.91
63.250.60.138
63.32.144.14
69.173.144.140
72.247.225.17
72.247.225.32
91.228.74.211
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
034024b3b8ae65014e2607e66694bf730d14b8e693440b47a98f6f06ec93de5b
03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
064e739a77f7623ba98eb109804d6d70d0773ee7be25f8a7d72e580fff406aa4
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a
0bffe3a273c7f7839ba27081fcf7b2f241db645c7e93f20a1260b89eee76ac00
0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
173bf971478c26c62d39568f01aba75e836f04fe65b35d755803382abea7e5f5
18cada9261c4f9c200316900d6ab365a430781e234591b7032028bdb2bad7192
1ae2e5ebdd5c2566b863b9b71843f509648470c8a5f8f7ed5d8ed01d33705a9f
1cab0468a17863ff221f656527f6fa55d6d9190ab05f27d6603e082fae16bb50
1e0d896233604f645a0c71f3e3c5a0cb0406cb99a911f7d224f7d74070eeec02
1ed6f6d8afefec7d237e704184698b3e1b41608f0e98ec5be077d940f66a2697
1f703cc979ec1a42c38021c0daf9993d4e72ed4f947445d04e84af951ae6d236
24c680d1584ba46d015f9d4a8c4ea0adaa53be3f1f798310e9273163b0af8330
26346c2997866a8c254ac5a4cb46a7ae15911cb16ab50eab94ba0211cc72c9e4
267de44d3e0da48ea910544cc6ae698dc28c977de6cb7baf62a4913765f49a2b
26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142
2886cb37ae9565ff853f695f1dd901549ef29661d21f4a9633d544bf8dd7c757
29bb72af92ce3a332ed2315043b17307ae458d3e3b7e24db3bb47417d6e433f8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b
2e14464924e0301cda997640b9918eb65cca0c896a4610e0b35101975b013adf
2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
35048607b21ee536902bdf863001c06a70dfe10e68f8970ff8e6d8d2c8001865
363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
370f89f6ebcec94f6a529911989dc8cd601a3cf2795b36cc3b5ba92fae8af47d
39ac46b13bedb7f0fdf649e1b604d551d1070130f08b8bfe74583bde4cc4ebbd
4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47
40fddc2a37b32e799d931b5bf87c338cc2eaf4be9591afb587e0ccb565f4fd65
41a3ed238e5ec4c932b6f0bd9f39801b903a55a82c4620e6c9d3a9a9e73e3811
42b3fc91a1ad52d699828c32fab5b6c562dd9b6e7f287bd300b589a9f010a60a
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
4477dd6cbad78ef9acc3c17095843a20dd110fe9adccea64a6db0b87086fdd81
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
46d112262e853b8310ff86f0432a4cf1856043609603879cefa976637db99b93
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
499884442dfa831d601fd0c2a89ec800b8d722819dec571243704ad7c3134592
4af00ba1a8bb2dd1374c5d434a9e0869343c8ea57922fdae7a53df4cf8bf40e4
4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f6a0f2ed3d7266da65abffc40108aff7ec33d6d63a020893de90235e66dc78f
50d2f618884e567744c75aa3376686433697a4dac4b66f720c2bb0f206ca0da1
519af704ada6648c0dec5ac7317ff903600ece818b61217fd43e64b8127259b2
5410bb2efa72fe5238e4d36cf1ab0f8a03408bc21b6349b58e6c0d1664b96453
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0
57273b1b7ecb9a6694127380c29ce2a2e62c62b1241f06b743666336a297140e
579d29f71b15657f86363fa09f655d4f41e3023e9601e46d81f56010eef88844
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5c8b3abfc048dad503e3e5a62c1518c4c0e933389e46f8339990b12c4deb9213
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994
6183c3c5d8c6ae96da5bff3aa17f1283a1340bf0c748a89f29890fe63ce5389b
62e5d5f4a0db067e567962cfe7b9b938e4a0b6a7c5cc2c72f822caad1d5388f9
65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba
68a006112d2811872b3b6b47e68c378280700a45c61bb3951deb632044b61f4f
698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79
69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174
6d40fc6a27a558f6f09b142ba587591cfe9d4f86ab0fd015a0c39ae9fb90e8eb
6f7aa5dfd1c09d9e48906ac4a86bb8d2335685bd7dfaeff60005cfb7d4d257cc
70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
761a8324e7e7cc5c30715cd8d5139110fe53182a94166456e6e5c121044cc1c5
76c828df931848541d008f5df340db07e1fd29788cd50f9f86198c9c452fdc9f
78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7bb3838ecccba1c744cc76c0b19d009f7b9419d74222a22708142e9edb5ec2be
7c79ada16090cc7e94af116173695bfd88da9efe580f89749e1160ba9d49c54c
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb
7deac7d749291f91aab0cb044b662cc3fcad6c7a7da56554d1ce144771e6d253
813628535187fe19c6e20047ec1987cb69c53a0fdc33b3bec28d2876a683a6d9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
856ebd974805a315c6419b50ff68e30ca94f384415d85af8c56cbb5479f3faa8
85983c4006e7ba32a14061bb4b1b6800f912e4eaebe1ba0244e17515c6f52272
8a9b040dfe4db54da8ad79d37d7c159a5652a5d89c649ddc59fc4e48b4096479
8c17613217b11da7589afe53aa138606274ad5c49d5638d5275b5ab4bbd76dcb
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
9358fd042faa601e271fb4c03ce8cbf093414c7dff34e8e54a24d002da113be5
94825a38fe05eb8161707b3783b7ad8e3405d2b9cb6a4e8b2e3c2390dedba33a
95db8a9b223e23289fdaca9a64bceddf52771d09ab7fabf6f72fa450c414810e
9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9
968f52680af792b0d892af779cdfc6a197c35698450088340c6a471b2e056a7d
96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093
9c09ec216d284cea1057b80f248d2e327376d04911cbedcfdafae58c79429ee7
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9dcdc83bf21b50a7a30e8628dc033e2505b134c8cd0dcf24823aed6534669d12
9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3
a02e6cb846a5e7a2d7f10a40c60be5d5f6bf9f432e994e688990712714cd4eb0
a032bc143a0d78657b8ef39bd54084bfe9d5857f89cede4e17029bf6b7b08c91
a19e5cb1dcf4a0e6b7df6307f8105c907eed64538b3f35784319b8b643332232
a25cfe179c17974ae9abe4af5e5e56e42b2657c18903d8f1f3f6f9b695f3e782
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a492f8c0fdbb910dbabf2370b67bcd120f5c82f974104e30c9307f152c2025c1
a837fab08c038562b05eb2eb81c1c340c8cd2762d2c43d5e3bb26c2980fc9bfb
a96de9b5cab3a965483ca1974e4c89f6e16b77ce6aa09ec9b58921a3da0778cd
aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
b028c2df0b60ae6849af0ddee92ff49d080d5cf91041bae321397f5bb046d1e9
b124b3787031cfbe2946d1e124d4ecb3affa8b1619b81cf247d851b242785b44
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bcbd3e81a658d08ccaf161f71a02478d6c355a9affd9a2325cb9e912b8f2fab9
bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3
bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29
c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3
c1e29d01c1f61adc2d02296035030ab1f4356bc04cae2d3c9f6f7baf653848f1
c1f2adccbf7066f001f789789a63d42dcc90b43abb28455ba7d36bf96fc02578
c4b5c1f949f059e3abb05ddcb7cc9944f8c16811e0eb1db9003bc5f8a4eb0634
c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8
c5bb33dea6eb71553b0b763cc6b0703703a3f6971256eb920b94963e40d6c749
c73e66343b58de4ecf1646d9910e95de94f4286795ce2a2c7ed7efacf6b60e63
c761e867921c708aad4ff9a03b9ee666830676748d786aa2d7ddec1db29b7c9c
c99edecede037e1dd887b6abed9749bd6733cbabdc43c3b81016de6ad5b81272
ca2fad3c80b0a8729a7ae3c47aa2849e078d1b3fb4bd9e4079f6b1988bb8f8bd
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d4f8f618b5ea26d134f3a21ea4d754f43ee936d8517133b80dcb6e7dea6d618b
d72afc407a3d6289f8150ea724ffd9ef215084236cfb6c831a3d91f136cda7ab
d847475ca969f76b8f8421c4150f23fbe5bef200839b80481b845a6ccdd6e86f
d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08
d9c80f88c3b68f5aa70d72e6cc3ee2b63c7304ae2d7d5a0699b2fde98d4e1100
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293
e85be7f78cb2c4957c023256ac897c1d6b559971337821d55f70e5e2809f103c
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ea25fc73e8b4a069e9c53b400146670ddc822371778baaffdab439765d66aaf5
eae511396b0f23a63d0595139d59e1859ba49c47dbe160bd56a8f055e4ed8acf
eba6f2bdbde062e0c8cc9e19f7263285c198e916d08c7b74e4a44dfdcca68ca8
ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458
f43d2cf395827366eb0b0ae06b9cc2446cd50b8cb198ad918bd550591c9e9571
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c

safehaven.com Open in urlscan Pro 52.43.18.65 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

218 Requests

99 %HTTPS

44 %IPv6

42 Domains

65 Subdomains

53 IPs

8 Countries

7110 kBTransfer

11401 kBSize

26 Cookies

3 Outgoing links

Page URL History

Redirected requests

218 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

safehaven.com Open in urlscan Pro
52.43.18.65 Public Scan

Screenshot
Live screenshot

Full Image

218
Requests

99 %
HTTPS

44 %
IPv6

42
Domains

65
Subdomains

53
IPs

8
Countries

7110 kB
Transfer

11401 kB
Size

26
Cookies

218 HTTP transactions
4 data transactions