www.pe.com Open in urlscan Pro
192.0.66.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Submission: On January 05 via api (January 5th 2022, 3:00:37 am UTC) from US — Scanned from DE

Summary HTTP 243 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 79 IPs in 9 countries across 62 domains to perform 243 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.pe.com.
TLS certificate: Issued by R3 on December 4th 2021. Valid for: 3 months.

This is the only time www.pe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
23	192.0.66.2 192.0.66.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
5	65.9.71.173 65.9.71.173	16509 (AMAZON-02) (AMAZON-02)
2	13.35.253.74 13.35.253.74	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	143.204.209.119 143.204.209.119	16509 (AMAZON-02) (AMAZON-02)
2	13.35.253.106 13.35.253.106	16509 (AMAZON-02) (AMAZON-02)
14	65.9.58.49 65.9.58.49	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:206... 2600:9000:206f:3200:3:b7e:8940:93a1	16509 (AMAZON-02) (AMAZON-02)
1	65.9.7.60 65.9.7.60	16509 (AMAZON-02) (AMAZON-02)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a02:26f0:710... 2a02:26f0:7100:594::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
14	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1	2a04:4e42:c00... 2a04:4e42:c00::282	54113 (FASTLY) (FASTLY)
1	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
1	143.204.215.88 143.204.215.88	16509 (AMAZON-02) (AMAZON-02)
1 5	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	65.9.58.124 65.9.58.124	16509 (AMAZON-02) (AMAZON-02)
1	13.35.253.16 13.35.253.16	16509 (AMAZON-02) (AMAZON-02)
3	54.167.130.168 54.167.130.168	14618 (AMAZON-AES) (AMAZON-AES)
6	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	3.208.83.212 3.208.83.212	14618 (AMAZON-AES) (AMAZON-AES)
2 4	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	52.86.156.15 52.86.156.15	14618 (AMAZON-AES) (AMAZON-AES)
1	34.120.133.55 34.120.133.55	15169 (GOOGLE) (GOOGLE)
1	151.101.130.217 151.101.130.217	54113 (FASTLY) (FASTLY)
2	2600:9000:205... 2600:9000:2057:3200:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	13.35.253.75 13.35.253.75	16509 (AMAZON-02) (AMAZON-02)
1	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	185.33.221.15 185.33.221.15	29990 (ASN-APPNEX) (ASN-APPNEX)
2	178.250.0.165 178.250.0.165	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	23.37.38.181 23.37.38.181	16625 (AKAMAI-AS) (AKAMAI-AS)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2602:803:c003... 2602:803:c003:200::51	26667 (RUBICONPR...) (RUBICONPROJECT)
1	18.195.229.145 18.195.229.145	16509 (AMAZON-02) (AMAZON-02)
1	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4	13.85.16.224 13.85.16.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.217.105.36 52.217.105.36	16509 (AMAZON-02) (AMAZON-02)
2	178.250.2.83 178.250.2.83	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	52.210.199.144 52.210.199.144	16509 (AMAZON-02) (AMAZON-02)
6 7	3.124.83.68 3.124.83.68	16509 (AMAZON-02) (AMAZON-02)
2 2	37.157.4.23 37.157.4.23	198622 (ADFORM) (ADFORM)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
18	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2.18.232.130 2.18.232.130	16625 (AKAMAI-AS) (AKAMAI-AS)
4	185.33.221.90 185.33.221.90	29990 (ASN-APPNEX) (ASN-APPNEX)
7	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	185.170.60.161 185.170.60.161	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1	13.35.253.42 13.35.253.42	16509 (AMAZON-02) (AMAZON-02)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.223.4.62 52.223.4.62	16509 (AMAZON-02) (AMAZON-02)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
1 2	172.67.177.215 172.67.177.215	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	185.33.221.11 185.33.221.11	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	2600:1f18:730... 2600:1f18:730:b150:54c0:d5f0:3e0a:5e72	14618 (AMAZON-AES) (AMAZON-AES)
1	52.5.181.6 52.5.181.6	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:400e:810::2001	15169 (GOOGLE) (GOOGLE)
1	142.250.184.198 142.250.184.198	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:827::2006	15169 (GOOGLE) (GOOGLE)
2 7	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
3 8	54.86.119.171 54.86.119.171	14618 (AMAZON-AES) (AMAZON-AES)
1	2.16.186.235 2.16.186.235	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.69.106.89 13.69.106.89	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	34.102.163.6 34.102.163.6	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2a05:d018:d29... 2a05:d018:d29:3601:2114:2cbc:c6ab:b127	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	209.54.176.128 209.54.176.128	16509 (AMAZON-02) (AMAZON-02)
1 1	64.202.112.95 64.202.112.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	104.26.5.15 104.26.5.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	2600:1f18:444... 2600:1f18:444a:4602:b51a:2bef:14:5241	14618 (AMAZON-AES) (AMAZON-AES)
2 2	52.211.32.39 52.211.32.39	16509 (AMAZON-02) (AMAZON-02)
1 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	35.210.53.219 35.210.53.219	15169 (GOOGLE) (GOOGLE)
1 1	2a04:4e42:200... 2a04:4e42:200::300	54113 (FASTLY) (FASTLY)
1	2a02:26f0:170... 2a02:26f0:1700:38a::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	13.35.253.23 13.35.253.23	16509 (AMAZON-02) (AMAZON-02)
2	18.157.162.207 18.157.162.207	() ()
243	79

23 192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

www.pe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 65.9.71.173 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-71-173.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.74 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-74.fra6.r.cloudfront.net

mng-pe.zeustechnology.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.209.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-209-119.fra53.r.cloudfront.net

cdn.auth0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-106.fra6.r.cloudfront.net

cdn.p-n.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 65.9.58.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-58-49.fra56.r.cloudfront.net

s033.pe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:3200:3:b7e:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cmp.osano.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.7.60 (Altamonte Springs, United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-7-60.fra56.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100:594::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
loader-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fp-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g2insights-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ayc0zsm69431gfebd.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:c00::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-88.fra53.r.cloudfront.net

ib.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.185.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.58.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-58-124.fra56.r.cloudfront.net

insights.zeustechnology.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-16.fra6.r.cloudfront.net

ats.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.167.130.168 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-167-130-168.compute-1.amazonaws.com

digitalfirstmedia.blueconic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::1c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.208.83.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-83-212.compute-1.amazonaws.com

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 15.197.193.217 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.86.156.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-156-15.compute-1.amazonaws.com

idx.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.133.55 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 55.133.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.217 (United States)

ASN54113 (FASTLY, US)

scripts.webcontentassessor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:3200:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.75 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-75.fra6.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.221.15 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.165 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.par.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.38.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-181.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:803:c003:200::51 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.229.145 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-229-145.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.78 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-dfm-proxy-connext.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.217.105.36 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

paywall-ad-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.83 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ssp-sync.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.199.144 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-199-144.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 3.124.83.68 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-83-68.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.4.23 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com

cdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.221.90 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ams1-ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.170.60.161 (Canada)

ASN27381 (CASALE-MEDIA, CA)

a2130.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-42.fra6.r.cloudfront.net

choices.truste.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.4.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac9557e2e67bd8033.awsglobalaccelerator.com

ie1-bid.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.177.215 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

metrics.getrockerbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.221.11 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:54c0:d5f0:3e0a:5e72 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.5.181.6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-181-6.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:400e:810::2001 (Ireland)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:827::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 76.223.111.18 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.86.119.171 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-119-171.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.235 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-235.deploy.static.akamaitechnologies.com

sli.pe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.69.106.89 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.163.6 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 6.163.102.34.bc.googleusercontent.com

ad.mrtnsvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3601:2114:2cbc:c6ab:b127 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.54.176.128 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.95 (United States) 1 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.5.15 (United States)

ASN13335 (CLOUDFLARENET, US)

api-mg2.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.132.245 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:444a:4602:b51a:2bef:14:5241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.211.32.39 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-32-39.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.53.219 (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 219.53.210.35.bc.googleusercontent.com

pool.admedo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::300 (United States) 1 redirects

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:38a::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

02179910.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.35.253.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-23.fra6.r.cloudfront.net

choices.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.157.162.207 (None, )

ASN- ()

k.p-n.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	pe.com www.pe.com s033.pe.com sli.pe.com	794 KB
26	googlesyndication.com pagead2.googlesyndication.com 12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com tpc.googlesyndication.com	110 KB
24	2mdn.net s0.2mdn.net	224 KB
15	liadm.com 4 redirects idx.liadm.com b-code.liadm.com rp.liadm.com rp4.liadm.com i.liadm.com i6.liadm.com	21 KB
12	doubleclick.net 1 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net	214 KB
10	ayc0zsm69431gfebd.xyz cdn.ayc0zsm69431gfebd.xyz	205 KB
9	gstatic.com fonts.gstatic.com www.gstatic.com	109 KB
9	3lift.com 2 redirects ib.3lift.com tlx.3lift.com eb2.3lift.com	5 KB
7	googletagservices.com www.googletagservices.com	196 KB
7	bidswitch.net 6 redirects x.bidswitch.net	3 KB
7	adnxs.com 1 redirects ib.adnxs.com cdn.adnxs.com ams1-ib.adnxs.com secure.adnxs.com	44 KB
7	criteo.com 1 redirects gum.criteo.com mug.criteo.com bidder.criteo.com ssp-sync.criteo.com	11 KB
7	amazon-adsystem.com 1 redirects c.amazon-adsystem.com s.amazon-adsystem.com	77 KB
6	trustarc.com choices.trustarc.com	17 KB
5	adsrvr.org 2 redirects match.adsrvr.org ie1-bid.adsrvr.org	3 KB
4	azurewebsites.net prod-dfm-proxy-connext.azurewebsites.net	322 KB
4	pubmatic.com ads.pubmatic.com hbopenbid.pubmatic.com image6.pubmatic.com	8 KB
4	p-n.io cdn.p-n.io k.p-n.io	58 KB
3	casalemedia.com htlb.casalemedia.com as-sec.casalemedia.com a2130.casalemedia.com	5 KB
3	blueconic.net digitalfirstmedia.blueconic.net	2 KB
3	azureedge.net loader-cdn.azureedge.net fp-cdn.azureedge.net g2insights-cdn.azureedge.net	238 KB
3	zeustechnology.com mng-pe.zeustechnology.com insights.zeustechnology.com	101 KB
3	googleapis.com fonts.googleapis.com ajax.googleapis.com	90 KB
2	admedo.com 2 redirects pool.admedo.com	718 B
2	addthis.com 1 redirects x.dlx.addthis.com	1 KB
2	demdex.net 2 redirects dpm.demdex.net	2 KB
2	visualstudio.com dc.services.visualstudio.com	407 B
2	getrockerbox.com 1 redirects metrics.getrockerbox.com	1 KB
2	taboola.com 1 redirects sync.taboola.com trc.taboola.com	669 B
2	adform.net 2 redirects c1.adform.net	948 B
2	google-analytics.com www.google-analytics.com	21 KB
2	scorecardresearch.com 1 redirects sb.scorecardresearch.com	779 B
2	rkdms.com 1 redirects mid.rkdms.com	2 KB
2	googletagmanager.com www.googletagmanager.com	148 KB
2	rlcdn.com ats.rlcdn.com api.rlcdn.com	38 KB
2	go-mpulse.net c.go-mpulse.net	51 KB
2	wp.com stats.wp.com pixel.wp.com	3 KB
2	osano.com cmp.osano.com	101 KB
2	jsdelivr.net cdn.jsdelivr.net	98 KB
1	akstat.io 02179910.akstat.io	351 B
1	mathtag.com 1 redirects sync.mathtag.com	676 B
1	db-ip.com api-mg2.db-ip.com	912 B
1	zemanta.com 1 redirects b1sync.zemanta.com	301 B
1	bing.com c.bing.com	593 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com	885 B
1	linkedin.com px.ads.linkedin.com	705 B
1	mrtnsvr.com 1 redirects ad.mrtnsvr.com	218 B
1	google.com 1 redirects www.google.com	299 B
1	mookie1.com odr.mookie1.com	324 B
1	moatads.com z.moatads.com	111 KB
1	truste.com choices.truste.com	9 KB
1	bidr.io match.prod.bidr.io	430 B
1	amazonaws.com paywall-ad-bucket.s3.amazonaws.com	1 KB
1	rubiconproject.com fastlane.rubiconproject.com	3 KB
1	webcontentassessor.com scripts.webcontentassessor.com	19 KB
1	indexww.com js-sec.indexww.com	14 KB
1	criteo.net static.criteo.net	39 KB
1	polyfill.io polyfill.io	594 B
1	msecnd.net az416426.vo.msecnd.net	22 KB
1	parsely.com cdn.parsely.com	21 KB
1	auth0.com cdn.auth0.com	38 KB
0	privacymanager.io Failed geo.privacymanager.io Failed
243	62

	Domain	Requested by
24	s0.2mdn.net	www.pe.com s0.2mdn.net
23	www.pe.com	www.pe.com cmp.osano.com
18	pagead2.googlesyndication.com	az416426.vo.msecnd.net www.pe.com mng-pe.zeustechnology.com www.googletagservices.com ad.doubleclick.net tpc.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net
14	s033.pe.com	www.pe.com s033.pe.com cmp.osano.com az416426.vo.msecnd.net
10	cdn.ayc0zsm69431gfebd.xyz	cmp.osano.com
8	i.liadm.com	3 redirects cmp.osano.com i.liadm.com
7	eb2.3lift.com	2 redirects cmp.osano.com eb2.3lift.com
7	tpc.googlesyndication.com	googleads.g.doubleclick.net www.pe.com tpc.googlesyndication.com s0.2mdn.net
7	www.googletagservices.com	securepubads.g.doubleclick.net mng-pe.zeustechnology.com googleads.g.doubleclick.net www.googletagservices.com s0.2mdn.net
7	x.bidswitch.net	6 redirects eb2.3lift.com
6	choices.trustarc.com	scripts.webcontentassessor.com
6	googleads.g.doubleclick.net	mng-pe.zeustechnology.com googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
5	c.amazon-adsystem.com	www.pe.com c.amazon-adsystem.com
4	ams1-ib.adnxs.com	mng-pe.zeustechnology.com www.pe.com cdn.adnxs.com
4	prod-dfm-proxy-connext.azurewebsites.net	cdn.ayc0zsm69431gfebd.xyz
4	match.adsrvr.org	2 redirects js-sec.indexww.com eb2.3lift.com
3	www.gstatic.com	googleads.g.doubleclick.net
3	digitalfirstmedia.blueconic.net	s033.pe.com cmp.osano.com
3	securepubads.g.doubleclick.net	mng-pe.zeustechnology.com cmp.osano.com securepubads.g.doubleclick.net
2	k.p-n.io	cdn.p-n.io
2	pool.admedo.com	2 redirects
2	x.dlx.addthis.com	1 redirects i.liadm.com
2	dpm.demdex.net	2 redirects
2	i6.liadm.com	i.liadm.com
2	s.amazon-adsystem.com	1 redirects eb2.3lift.com
2	cm.g.doubleclick.net	1 redirects eb2.3lift.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	metrics.getrockerbox.com	1 redirects www.pe.com
2	c1.adform.net	2 redirects
2	www.google-analytics.com	cmp.osano.com
2	ssp-sync.criteo.com	static.criteo.net www.pe.com
2	bidder.criteo.com	static.criteo.net
2	sb.scorecardresearch.com	1 redirects www.pe.com
2	b-code.liadm.com	cmp.osano.com
2	mid.rkdms.com	1 redirects www.pe.com
2	gum.criteo.com	1 redirects cmp.osano.com
2	www.googletagmanager.com	cmp.osano.com
2	ads.pubmatic.com	mng-pe.zeustechnology.com cmp.osano.com
2	c.go-mpulse.net	www.pe.com c.go-mpulse.net
2	cmp.osano.com	www.pe.com cmp.osano.com
2	cdn.p-n.io	www.pe.com cmp.osano.com
2	mng-pe.zeustechnology.com	www.pe.com
2	fonts.googleapis.com	www.pe.com googleads.g.doubleclick.net
2	cdn.jsdelivr.net	www.pe.com cdn.jsdelivr.net
1	02179910.akstat.io	c.go-mpulse.net
1	trc.taboola.com	1 redirects
1	sync.mathtag.com	1 redirects
1	api-mg2.db-ip.com	cdn.ayc0zsm69431gfebd.xyz
1	b1sync.zemanta.com	1 redirects
1	c.bing.com	eb2.3lift.com
1	pr-bh.ybp.yahoo.com	1 redirects
1	px.ads.linkedin.com	eb2.3lift.com
1	ad.mrtnsvr.com	1 redirects
1	sli.pe.com
1	www.google.com	1 redirects
1	ad.doubleclick.net	srcdoc
1	rp4.liadm.com	www.pe.com
1	rp.liadm.com	1 redirects
1	secure.adnxs.com	1 redirects
1	odr.mookie1.com	www.pe.com
1	ie1-bid.adsrvr.org	mng-pe.zeustechnology.com
1	z.moatads.com	mng-pe.zeustechnology.com
1	choices.truste.com	mng-pe.zeustechnology.com
1	a2130.casalemedia.com	mng-pe.zeustechnology.com
1	cdn.adnxs.com	mng-pe.zeustechnology.com
1	12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com	cmp.osano.com
1	sync.taboola.com	www.pe.com
1	match.prod.bidr.io	www.pe.com
1	as-sec.casalemedia.com	az416426.vo.msecnd.net
1	paywall-ad-bucket.s3.amazonaws.com	www.pe.com
1	image6.pubmatic.com	ads.pubmatic.com
1	tlx.3lift.com	mng-pe.zeustechnology.com
1	fastlane.rubiconproject.com	mng-pe.zeustechnology.com
1	hbopenbid.pubmatic.com	mng-pe.zeustechnology.com
1	htlb.casalemedia.com	mng-pe.zeustechnology.com
1	ib.adnxs.com	mng-pe.zeustechnology.com
1	mug.criteo.com	gum.criteo.com
1	scripts.webcontentassessor.com	cmp.osano.com
1	g2insights-cdn.azureedge.net	cmp.osano.com
1	fp-cdn.azureedge.net	cmp.osano.com
1	api.rlcdn.com	js-sec.indexww.com
1	idx.liadm.com	js-sec.indexww.com
1	pixel.wp.com	www.pe.com
1	loader-cdn.azureedge.net	ajax.googleapis.com
1	ats.rlcdn.com	www.pe.com
1	insights.zeustechnology.com	mng-pe.zeustechnology.com
1	ib.3lift.com	mng-pe.zeustechnology.com
1	js-sec.indexww.com	mng-pe.zeustechnology.com
1	static.criteo.net	mng-pe.zeustechnology.com
1	polyfill.io	ajax.googleapis.com
1	az416426.vo.msecnd.net	www.pe.com
1	stats.wp.com	www.pe.com
1	cdn.parsely.com	www.pe.com
1	cdn.auth0.com	www.pe.com
1	ajax.googleapis.com	www.pe.com
0	geo.privacymanager.io Failed	ats.rlcdn.com
243	97

This site contains links to these domains. Also see Links.

Domain
www.medianewsgroup.com
pe.ca.newsmemory.com
event.pe.com
comicskingdom.com
www.legacy.com
adportal.pe.com
checkout.pe.com
mng-prod.auth0.com
www.accuweather.com
myaccount.pe.com
enewspaper.pe.com
mediakit.scng.com
thetrustproject.org
facebook.com
twitter.com
instagram.com
www.denverpost.com
www.nydailynews.com
www.mercurynews.com
www.socalnewsgroup.com
www.digitalfirstmedia.com
digitalfirstmedia.wd5.myworkdayjobs.com
www.socalnie.com
marketplace.socaladsonline.com
scng.column.us
adportal.socaladsonline.com
careers.socalnewsgroup.com
vip.wordpress.com

Subject Issuer	Validity	Valid
pe.com R3	`2021-12-04` - `2022-03-04`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.zeustechnology.com Amazon	`2021-05-15` - `2022-06-13`	a year	crt.sh
*.auth0.com Amazon	`2021-04-25` - `2022-05-24`	a year	crt.sh
pushlycdn.com Amazon	`2021-03-16` - `2022-04-14`	a year	crt.sh
u066.ocregister.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
cmp.osano.com Amazon	`2021-09-17` - `2022-10-16`	a year	crt.sh
*.parsely.com Amazon	`2021-07-05` - `2022-08-03`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2021-06-08` - `2022-06-13`	a year	crt.sh
sni1e6ffgl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2020	`2021-06-04` - `2022-07-06`	a year	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-12-01` - `2022-02-24`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
sni22a5dgl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-08` - `2022-10-09`	a year	crt.sh
*.blueconic.net Thawte TLS RSA CA G1	`2019-12-04` - `2022-02-01`	2 years	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-12-01` - `2022-02-26`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.liadm.com Amazon	`2021-10-31` - `2022-11-28`	a year	crt.sh
sni1ad09gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-01` - `2022-11-01`	a year	crt.sh
sni1ad03gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-01` - `2022-11-01`	a year	crt.sh
sni9642gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-02-20` - `2022-03-22`	a year	crt.sh
scripts.webcontentassessor.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-10-31` - `2022-12-02`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.azurewebsites.net Microsoft RSA TLS CA 02	`2021-07-07` - `2022-07-07`	a year	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
*.match.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-03-11` - `2022-02-07`	a year	crt.sh
casalemedia.com Go Daddy Secure Certificate Authority - G2	`2021-01-13` - `2022-02-14`	a year	crt.sh
*.truste.com Amazon	`2021-02-16` - `2022-03-17`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
sli.chicoer.com R3	`2021-10-14` - `2022-01-12`	3 months	crt.sh
in.applicationinsights.azure.com Microsoft RSA TLS CA 01	`2021-07-22` - `2022-07-22`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2021-12-06` - `2022-06-06`	6 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-12-22` - `2022-06-22`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-17` - `2022-06-16`	a year	crt.sh
*.trustarc.com Go Daddy Secure Certificate Authority - G2	`2020-05-21` - `2022-07-17`	2 years	crt.sh
*.p-n.io Amazon	`2021-01-26` - `2022-02-23`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Frame ID: AC0D1BC82BF8A0CC5BE1687335A65D26
Requests: 131 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 27692261B35D7953E4F5AC3CAC5F5D60
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.pe.com
Frame ID: 972F66876D9692A39C27065BE72AE12A
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=CPSUmIUPSUmIUEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&gdpr=1&us_privacy=1---&
Frame ID: F9BCCB76057F4C8FCCB9135BC4B28526
Requests: 2 HTTP requests in this frame

Frame: https://12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: C2DFE1B854586D6B9ECB1858C4771802
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvVYr-7DI2kp9bW03cSneFsjG5WllYD5SSvn4zcQV6Nn-5-jRR-PcMJzm8eFLvXWdeuY3bR7h96wBgjiT4z0Z1IqFIT5OeNMFkL8gh-k4sAEmCSK2a7ajdLWkZ9Jsn2rM15BR5vQt9iMJbwmYembyaA6iLF_VXDP1P77CYg0gCsGuIdLBKJ6FHijdkJwvpWQezQnShJ_caNV25nl388WfeDCyUWsswSp7NrRkzVS-lpC-zCKtVEJ2fmcZXV9VXr2DeFo25o-ZBue2lm1mm79M-rC3r2GtqzwBoK5Zki4MTjWCUweenM9V-Ty8R2HlmOZUFwqk58&sig=Cg0ArKJSzPmDBkRG_FC5EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 4CC99AB8E110A79F36E5074EDC2A77EC
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Frame ID: 3D0EE2CFAF0E2940C5CC2189F3A1F7F4
Requests: 16 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjstDM8JcZfvZp2aBKZNGMZFeqPhAhkbxSHcZOLXoss4RnvV9QzNZpfwaZYLEJ7JU7wU_bd1DqKuGHSJvihKrLE0VW_5gA_BosQI3knc0faCecGq2tdK4T4Mug_gqBVVPB7iafAvKhM_6ZnwdShM2fA-yVNL5kuct1SQwV3o8ISwHqOV-tuudkajA0uJ3s5syI0iboZggQ5-5rNEzniG0McVTwNDuGxKGq7n97SDf6DQc2GOzbxEMV2vp0L85rWESjPACniOFP1lwMHRUU-y6OxqOzHCfLvfNMhsQK3eIcA25onHxNycyHL9UkFvPd-mLINJPlQQ&sig=Cg0ArKJSzPjbYMDhvF68EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 99F4B348064D0B02BFCB7E83B1E927B2
Requests: 16 HTTP requests in this frame

Frame: https://a2130.casalemedia.com/ifnotify?consent=0&c=17B91C4&r=163DD010&t=61D509CF&u=X19RLU1NMTJGZS1JN3dFS0xrMUFtckVV&m=9d12270b2deb277effd502063db6ff8d&wp=E&aid=5c8b7412-332a-c26d-3f85-49a9cf9f17b3&tid=13B54&s=33E6E&cp=0.14&n=www.pe.com&pr=xx&sid=f774&epr=45c12253-d19b-4f90-8ceb-e69cecfed4a6
Frame ID: 67C20CD7A8877475E147E0D297192C4F
Requests: 1 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/adj/N1549806.422087GROUPMCOMPETENCEC/B26509325.315074782;dc_ver=81.236;sz=300x600;u_sd=1;gdpr_consent=CPSUmIfPSUmIfEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA;gdpr=1;nel=1;kw=5llqzru;dc_adk=1575238835;ord=bopew2;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fimp%3Dcd362a7a-d49a-4c98-b2f3-96468e9b24ee%26ag%3D5llqzru%26sfe%3D140c89cf%26sig%3D-CYReVcXBivVEgHT18Z4y3AVcPbX-kGOXMKUm4Mk3Fg.%26crid%3Dwwgxhbhm%26cf%3D2909522%26fq%3D0%26t%3D1%26td_s%3Dwww.pe.com%26rcats%3Dgce%26mcat%3D%26mste%3D%26mfld%3D2%26mssi%3D%26mfsi%3D%26sv%3Dcasale%26uhow%3D76%26agsa%3D%26wp%3DYdUJzwAAAAAwYFZkcAQaCRyeY209iE-oyGr3Pw%26rgz%3D60313%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D185707%26rlangs%3Dde%26mlang%3D%26did%3D%26rcxt%3DOther%26tmpc%3D5.87%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgdHZXJtYW55EgVIZXNzZRoAIhFGcmFua2Z1cnQgYW0gTWFpbjgBUAGAAQCIAQGQAQA.%26dur%3DCjAKDGNoYXJnZS1hbGwtMSIgCP___________wESE3R0ZF9kYXRhX2V4Y2x1c2lvbnMKSAohY2hhcmdlLWFsbE1vYXRWaWV3YWJpbGl0eVRyYWNraW5nIiMIpf__________ARIObW9hdC1yZXBvcnRpbmcqBgigjQYYDA..%26durs%3DAuzKvO%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%20-%20Windows%26pcm%3D1%26ict%3DUnknown%26said%3D5c8b7412-332a-c26d-3f85-49a9cf9f17b3%26auct%3D1%26grdc%3DCAE.%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F$0;xdt=0;crlt=vFqRJ*9P_I;cmpl=8;gcsr=a;sttr=195;prcl=s
Frame ID: 640BEF447DCDC1536C20EF946D9803D2
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E6CF5C218B76C3B2B4B5B92C650FA27C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 35B35A651DE2D920B84DDECE84BB3B97
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
Frame ID: 08DFAAE98A245596B67B81A2B1C98CF4
Requests: 25 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js
Frame ID: FFDB213DB896CCD96D539C028DD1AB6B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js
Frame ID: 7BD9D1C0DB189040768CEC9B2DC9EF47
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 1C0130BDE0553D6D9DBF13A2306FE102
Requests: 11 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-05gf?s=&cim=&ps=true&ls=true&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Frame ID: 728458595E53463271956DC1C6E4DC3D
Requests: 8 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 3D548FEBC32D978AFD819670981DE074
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

As Clinton Foundation donations plunge, questions raised – Press EnterpriseSchließen Sie diesen DialogSchließen Sie die Cookie-Einstellungen

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Backbone.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

backbone.*\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

243
Requests

89 %
HTTPS

33 %
IPv6

62
Domains

97
Subdomains

79
IPs

9
Countries

3603 kB
Transfer

12564 kB
Size

57
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.medianewsgroup.com/privacy-policy/
Title: Datenspeicherungsrichtlinie

Search URL Search Domain Scan URL

URL: http://pe.ca.newsmemory.com/ssindex.php
Title: Special Sections

Search URL Search Domain Scan URL

URL: http://event.pe.com/
Title: Events

Search URL Search Domain Scan URL

URL: https://comicskingdom.com/?utm_source=dfm
Title: Comics

Search URL Search Domain Scan URL

URL: http://www.legacy.com/obituaries/pe/
Title: Obituaries

Search URL Search Domain Scan URL

URL: http://adportal.pe.com/lang-adportal/pe-obits/index.html
Title: Place an Obituary

Search URL Search Domain Scan URL

URL: https://checkout.pe.com/?g2i_source=nav&g2i_medium=link&g2i_campaign=MG2NAV&g2i_or_o=Internt5&g2i_or_p=MG2NAV
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://mng-prod.auth0.com/v2/logout?returnTo=https%3A%2F%2Fwww.pe.com
Title: Logout

Search URL Search Domain Scan URL

URL: http://www.accuweather.com/en/us/riverside-ca/92506/current-weather/38709_pc?lang=en-us&partner=mng_2
Title: 57°F

Search URL Search Domain Scan URL

URL: https://myaccount.pe.com/pe/preference
Title: Sign Up For Newsletters

Search URL Search Domain Scan URL

URL: https://enewspaper.pe.com/
Title: E-edition

Search URL Search Domain Scan URL

URL: https://myaccount.pe.com/
Title: Subscribe + Subscriber Services

Search URL Search Domain Scan URL

URL: https://mediakit.scng.com/
Title: Advertising Services

Search URL Search Domain Scan URL

URL: https://thetrustproject.org/

Search URL Search Domain Scan URL

URL: https://checkout.pe.com/?g2i_source=nav&g2i_medium=link&g2i_campaign=adbox&g2i_or_o=Internt5&g2i_or_p=MG2NAV
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://facebook.com/ThePressEnterprise
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/pressenterprise
Title: Twitter

Search URL Search Domain Scan URL

URL: https://instagram.com/pressenterprise
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.denverpost.com/2022/01/02/marshall-fire-origin-twelve-tribes/
Title: Investigators Narrow Colorado Fire’s Origin To Single Neighborhood

Search URL Search Domain Scan URL

URL: https://www.denverpost.com/2022/01/02/marshall-fire-louisville-superior/
Title: One Of Three People Missing After Colorado Wildfire Is Found Alive

Search URL Search Domain Scan URL

URL: https://www.nydailynews.com/sports/football/jets/ny-antonio-brown-20220102-stgmw4b5cbeudnouhnwbp4j47u-story.html
Title: Antonio Brown’s Bucs Tenure Over After Throwing Uniform Toward Stands, Walking Off Field In Middle Of Game Vs. Jets

Search URL Search Domain Scan URL

URL: https://www.mercurynews.com/2022/01/02/aoife-beary-irish-student-who-survived-berkeley-balcony-collapse-dies-at-27/
Title: Aoife Beary, Irish Student Who Survived California Balcony Collapse, Dies At 27

Search URL Search Domain Scan URL

URL: https://www.denverpost.com/2022/01/02/marshall-fire-aerial-photos/
Title: PHOTOS: Aerial Images Of Colorado Wildfire Show Scale Of Devastation

Search URL Search Domain Scan URL

URL: http://www.socalnewsgroup.com/about-scng-1/
Title: Southern California News Group

Search URL Search Domain Scan URL

URL: http://www.socalnewsgroup.com/
Title: Partners

Search URL Search Domain Scan URL

URL: http://www.digitalfirstmedia.com/
Title: MediaNews Group

Search URL Search Domain Scan URL

URL: https://digitalfirstmedia.wd5.myworkdayjobs.com/MNG
Title: Work With Us

Search URL Search Domain Scan URL

URL: https://www.socalnie.com/
Title: Newspapers in Education

Search URL Search Domain Scan URL

URL: https://marketplace.socaladsonline.com/scng
Title: Classified

Search URL Search Domain Scan URL

URL: http://scng.column.us/
Title: Legals

Search URL Search Domain Scan URL

URL: https://adportal.socaladsonline.com/scng-adportal/pe-obits/index.html
Title: Obituary

Search URL Search Domain Scan URL

URL: https://careers.socalnewsgroup.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://checkout.pe.com/
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://myaccount.pe.com/pe/rewards
Title: Reader Rewards

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/copyright/
Title: Copyright ©2021 MediaNews Group, Inc.

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/accessibility-statement/
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/cookie-policy/
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/arbitration/
Title: Arbitration

Search URL Search Domain Scan URL

URL: http://vip.wordpress.com/
Title: Powered by WordPress.com VIP

Search URL Search Domain Scan URL

URL: https://www.medianewsgroup.com/california-consumer-privacy-act/
Title: Do Not Sell My Info

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=MEDIANEWSGROUP HTTP 302
https://mid.rkdms.com/restricted

Request Chain 78

https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&c9=

Request Chain 79

https://gum.criteo.com/sid/json?origin=publishertag&domain=www.pe.com&sn=ChromeSyncframe&so=0&topUrl=www.pe.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=jY47Cnxpd1RtRVVkVE9TZldXOUVvVEdSeS9PQ09BN0puYnhydldDcldkNlI3Y0lTeFdOSXM4VUoxSDFSQnB2aC80MlhsN1BKMkRqVitoUEd3YVBvckdOUDVZT0FDWVF3S0JLY2Y0allXbFFDRFJxVVMwdmdjR0JHRFJ0ZUVCTzVYVkwzeDl0R1pQUXJzSnVybThlK0Vrbzg1eVpRdUU1bEhOU0dKY1EyZTlkSExMU3p5S1htaWgzeEFkQ1lTQTJSTWVBQ0xRM0s4YTFxSXZOSWNEOGYwcmtOZ0F0eG4xUHFvekR1YkpuN3o1UzZnRlBsZFAxUVJucDAxbGd5SUNsMkN2blFQQU9tRy9aVmtxZzh4S2RQelFsMjFiQT09fA&cppv=2

Request Chain 99

https://x.bidswitch.net/sync?ssp=criteo&custom_data=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-7Q29Jt9d4ntK5iqR4TtMCSkV9sljfJEoBKDIfQ HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-7Q29Jt9d4ntK5iqR4TtMCSkV9sljfJEoBKDIfQ HTTP 302
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=criteo HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=criteo HTTP 302
https://x.bidswitch.net/sync?dsp_id=70&user_id=4721132336764932446&ssp=criteo HTTP 302
https://ssp-sync.criteo.com/user-sync/match?p=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&u=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Request Chain 122

https://match.adsrvr.org/track/cmf/generic?ttd_pid=mookie-ps&ttd_tpi=1 HTTP 302
https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898&gdpr=1&gdpr_consent=

Request Chain 123

https://metrics.getrockerbox.com/track/v4?source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fmetrics.getrockerbox.com%2Ftrack%2Fv4%3Fuid%3D%24UID%26source%3Dweight_watchers_subscription_germany%26tier_one%3Dttd-display%26tier_two%3Dr9vak6v%26tier_three%3D5llqzru%26tier_four%3Dwwgxhbhm%26uid_ts%3D1641351631 HTTP 302
https://metrics.getrockerbox.com/track/v4?uid=4042104120816151112&source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm&uid_ts=1641351631

Request Chain 135

https://rp.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&ext_IXWRAPPERLiveIntentIp=%7B%22t%22%3A1641351631147%2C%22d%22%3A%7B%22response%22%3A%22match%22%2C%22version%22%3A%221.1.1%22%2C%22data%22%3A%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22efk18l7o%2BI%2FpASPUR8sB1mKaTxWNStxReRTndgZDnT0bd6W%2FgzMMos8BSEAm4pjSEG6I2nf2OVNnunhUdQ99BLhJrrSCLvH95N1caNYlBx8Y23dwi6c5CNFgRSBVI0qLykmgj%2BkylQuS5jDWbhBkKldUwUyL19YJ5IYUrOIIn5Y%3D%22%2C%22ext%22%3A%7B%22keyID%22%3A13%2C%22rtiPartner%22%3A%22LDID%22%2C%22enc%22%3A1%7D%7D%5D%7D%7D%2C%22e%22%3A1641610831147%7D&us_privacy=1---&wpn=lc-bundle&gdpr=1&gdpr_consent=CPSUmIdPSUmIdEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&c=PHRpdGxlPkFzIENsaW50b24gRm91bmRhdGlvbiBkb25hdGlvbnMgcGx1bmdlLCBxdWVzdGlvbnMgcmFpc2VkIOKAkyBQcmVzcyBFbnRlcnByaXNlPC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZXNlbiBEaWFsb2c8IS0tLS0-PC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZSBDb29raWUtRWluc3RlbGx1bmdlbjwhLS0tLT48L3RpdGxlPjxoMSBjbGFzcz0iZW50cnktdGl0bGUiPgoKCQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBtZXRlcmVkIj4KCQkJQXMgQ2xpbnRvbiBGb3VuZGF0aW9uIGRvbmF0aW9ucyBwbHVuZ2UsIHF1ZXN0aW9ucyByYWlzZWQJCTwvc3Bhbj4KCgkKCTwvaDE- HTTP 302
https://rp4.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&ext_ixwrapperliveintentip=%7B%22t%22%3A1641351631147%2C%22d%22%3A%7B%22response%22%3A%22match%22%2C%22version%22%3A%221.1.1%22%2C%22data%22%3A%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22efk18l7o%2BI%2FpASPUR8sB1mKaTxWNStxReRTndgZDnT0bd6W%2FgzMMos8BSEAm4pjSEG6I2nf2OVNnunhUdQ99BLhJrrSCLvH95N1caNYlBx8Y23dwi6c5CNFgRSBVI0qLykmgj%2BkylQuS5jDWbhBkKldUwUyL19YJ5IYUrOIIn5Y%3D%22%2C%22ext%22%3A%7B%22keyID%22%3A13%2C%22rtiPartner%22%3A%22LDID%22%2C%22enc%22%3A1%7D%7D%5D%7D%7D%2C%22e%22%3A1641610831147%7D&us_privacy=1---&wpn=lc-bundle&gdpr=1&gdpr_consent=CPSUmIdPSUmIdEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&c=PHRpdGxlPkFzIENsaW50b24gRm91bmRhdGlvbiBkb25hdGlvbnMgcGx1bmdlLCBxdWVzdGlvbnMgcmFpc2VkIOKAkyBQcmVzcyBFbnRlcnByaXNlPC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZXNlbiBEaWFsb2c8IS0tLS0-PC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZSBDb29raWUtRWluc3RlbGx1bmdlbjwhLS0tLT48L3RpdGxlPjxoMSBjbGFzcz0iZW50cnktdGl0bGUiPgoKCQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBtZXRlcmVkIj4KCQkJQXMgQ2xpbnRvbiBGb3VuZGF0aW9uIGRvbmF0aW9ucyBwbHVuZ2UsIHF1ZXN0aW9ucyByYWlzZWQJCTwvc3Bhbj4KCgkKCTwvaDE-&i6=MmEwZjo5NDQxOjU6MDplNTo6MQ%3D%3D

Request Chain 159

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 198

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 205

https://ad.mrtnsvr.com/sync/triplelift HTTP 302
https://eb2.3lift.com/xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf

Request Chain 206

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENhsTq7G1DoUrG4HsyielHg&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

Request Chain 207

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg0NzQyNjgxODM3NTc1Mjg1

Request Chain 209

https://pr-bh.ybp.yahoo.com/sync/triplelift/384742681837575285?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2662&xuid=y-BhxHYk5E2oSMRtK0kxP59KBLgHJOWt5gr0_isrSbOQ--~A&dongle=0883

Request Chain 212

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=384742681837575285 HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=384742681837575285&dcc=t

Request Chain 213

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

Request Chain 217

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid%3D7156%26muid%3D%5BMM_UUID%5D&f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1--- HTTP 302
https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=7156&muid=b1ef61d5-09d0-4b00-aa66-76efd2e05097

Request Chain 218

https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&us_privacy=1--- HTTP 302
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898 HTTP 303
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898

Request Chain 219

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=https:%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-05gf%2F0%2F8e64e57691a841fb823da5568e7e1ecf%3Fmpid=82775&muid=$%7BDD_UUID%7D?us_privacy=1--- HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=https:%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-05gf%2F0%2F8e64e57691a841fb823da5568e7e1ecf%3Fmpid=82775&muid=$%7BDD_UUID%7D HTTP 302
https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=82775

Request Chain 220

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1--- HTTP 302
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---&rd=Y

Request Chain 221

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1--- HTTP 302
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037 HTTP 303
https://i6.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Request Chain 222

https://x.bidswitch.net/sync?ssp=liveintent&user_id=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1--- HTTP 302
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=8a5c3ef5-a438-4523-9f5f-6b05dea6c037 HTTP 302
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=8a5c3ef5-a438-4523-9f5f-6b05dea6c037 HTTP 302
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=a0dc42e1-1dac-431b-b107-0acda5007d5d&user_group=1&ssp=liveintent&bsw_param=8a5c3ef5-a438-4523-9f5f-6b05dea6c037 HTTP 302
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Request Chain 223

https://trc.taboola.com/sg/liveintent/1/cm/?us_privacy=1--- HTTP 302
https://i.liadm.com/s/32441?bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f HTTP 303
https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f&previous_uuid=faea0ea8cb4043a9b3e294032e44c7b4

243 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/ 187 KB
43 KB 30ms
6ms Document
text/html 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx / WordPress VIP <https://wpvip.com>

Resource Hash

60491e41ca279edb8cb82e9de2b860867f1e7b2373db30833769017f937d2ce2

Security Headers

Name

Value

Content-Security-Policy

default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;

Strict-Transport-Security

max-age=31536000;includeSubdomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Wed, 05 Jan 2022 03:00:29 GMT
content-type: text/html; charset=UTF-8
content-length: 42963
content-security-policy: default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://www.pe.com/wp-json/>; rel="https://api.w.org/" <https://www.pe.com/wp-json/wp/v2/posts/3346815>; rel="alternate"; type="application/json" <https://wp.me/p8AbZX-e2ET>; rel=shortlink
x-rq: hhn2 0 4 9980
cache-control: max-age=300, must-revalidate
content-encoding: gzip
age: 7
x-cache: hit
vary: Accept-Encoding
accept-ranges: bytes
strict-transport-security: max-age=31536000;includeSubdomains

GET
H2 200 /
www.pe.com/_static/ 100 KB
15 KB 7ms
5ms Stylesheet
text/css 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJyNUdFOwzAM/CHcaAX1bUJ8ipuY1sxJq9jR1L8nW4fWAkM8Refznc+xO8/AyUsJpM6rusBqrpfJn0C4z5gXp7YINZFTUxue3FbxoS5SYCShSMl2YBZcKIPQgH75n7xyW7wT+SnZpWeWMnCqQd8jWC5q1S6wR5uy1qho7K+LfOf+NBsJ84mSm0svN/2tBGvpoTKmAbDYWGuXQTylrxA/meb6k/rQS9kI9oC2K6nPROnXRbxwfSCWuz579xbUoSrZets49SwEGEbSGgfWw1bmNR4P3cvhue3atvsEU5vIhw==

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0487a37bad6efd2f3dad258f1fc6ae821d5aab982f1cb542e2d12b7950b60259

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 19:57:06 GMT
server: nginx
age: 20172
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 14983

GET
H2 200 bootstrap-icons.min.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 56 KB
9 KB 31ms
6ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 1193157
x-jsd-version: 1.5.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 9099
etag: W/"e199-MKfLdwDci4zij+cy307LMP/uJk4"
x-served-by: cache-fra19149-FRA
x-jsd-version-type: version
date: Wed, 05 Jan 2022 03:00:29 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 42ms
19ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%2C600%2C700%7CSource+Serif+Pro%3A400%2C700&ver=5.8.2

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cad03ccdac0d4de0806a5523bc216329edfce0fdde0a15900c37601bd5c378e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 05 Jan 2022 03:00:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 05 Jan 2022 03:00:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 05 Jan 2022 03:00:29 GMT

GET
H2 200 /
www.pe.com/_static/ 99 KB
25 KB 9ms
6ms Stylesheet
text/css 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJyVj9EKwjAMRX/ILKvUvYmfIiWNpdo2xWQM/94NFPRN33IvnMMNLh1ImnEz7GVOuSnGS4UQoUpUVAuWCUnXk+7Mbai5DWvc4QdZZ3jDV7Ye6AZuHDyuirmw4pJjYlM06dBFbfM+Cv/sOedGqEI5FCiSRL/CX5O2T17Fxpzq0U3e7afRH/wTb5thDg==

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b6a26d9387f340a97733c16fb917032a810679a11820112b0e592a5c90ceb2af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20172
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 25310

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 134 KB
36 KB 53ms
9ms Script
application/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: Server /
Resource Hash: de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: qkOcdGsoDUMvfWusL4m2BAijBZa3LkSN
content-encoding: gzip
etag: 1e39d25f07f5619925357b752ab10d04
age: 581
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 1BHT330DTHNFG4J1W12G
date: Wed, 05 Jan 2022 02:50:49 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: kleKJ2aQAczfFnrc3CPfzmJAVyRwOcfOINahgbBCAQrgvZ_cFGXtvg==

GET
H2 200 zeus-adapter.js Show response
www.pe.com/wp-content/plugins/dfm_zeus/assets/dist/ 17 KB
6 KB 8ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/plugins/dfm_zeus/assets/dist/zeus-adapter.js?m=1641260454g

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

84c9c9d4de88f5cf5e9ed1803bc3dc4a3a60be607d5b1d1c690151144e6a8a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20172
etag: W/"61d3a5a6-43df"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 5667
expires: Thu, 05 Jan 2023 03:00:29 GMT

GET
H2 200 main.js Show response
mng-pe.zeustechnology.com/ 212 KB
50 KB 45ms
19ms Script
application/javascript 13.35.253.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mng-pe.zeustechnology.com/main.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-74.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89e5f27ec88b0725701cd952755856b8596ff4e3d8313fbaecf1abbdfdfb5f7d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: osX_L6pvJf.BtrG9OQyLApLYdG3swDW8
content-encoding: br
last-modified: Fri, 12 Nov 2021 18:33:35 GMT
server: AmazonS3
age: 956
etag: W/"70d9776b3c308c8caf4c17c397090e32"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
cache-control: max-age=600,s-maxage=3600
date: Wed, 05 Jan 2022 02:44:34 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: b3i1aAAsM3qNXhiZwRtOuv_99OEwg_jgG6hjut8Gn4BhMon9Al9mKw==

GET
H2 200 / Show response
www.pe.com/_static/ 9 KB
3 KB 12ms
10ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJyNjEEKwjAQRS9kOlZid+IRFHoAqelUEjKTkp8geHpbsNClq89/8B69Z+OSFtZCc6wvr6BxkseHK2gAuCzfo6zQrNA8q46Rm4AD7VwX/TJGqtkqyI7unKeUZVDHWyyAZK4R3IjX/yp9f9vZQDIlpYhf4CqXtrPtqTvasw1fLLRMnQ==

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

dc7a07d5c4d96d1a7458827b6feff4d2519e75ed313d741abdcebadd394d3ae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20172
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 3153

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
88 KB 30ms
6ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 00:01:43 GMT
x-content-type-options: nosniff
age: 10726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89476
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Jan 2023 00:01:43 GMT

GET
H2 200 loader.min.js Show response
www.pe.com/wp-content/plugins/loader-wp/static/ 16 KB
5 KB 12ms
11ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Mon, 15 Nov 2021 18:19:41 GMT
server: nginx
age: 4139438
etag: W/"6192a4bd-3e4a"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 5454
expires: Thu, 05 Jan 2023 03:00:29 GMT

GET
H2 200 auth0-spa-js.production.js Show response
cdn.auth0.com/js/auth0-spa-js/1.13/ 105 KB
38 KB 62ms
9ms Script
application/javascript 143.204.209.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.auth0.com/js/auth0-spa-js/1.13/auth0-spa-js.production.js?ver=5.8.2
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.209.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-209-119.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: 6AzkYKZDwDnSxmQe5SqIWFlWTPBMtbyI
content-encoding: gzip
last-modified: Thu, 07 Jan 2021 14:32:49 GMT
server: AmazonS3
age: 9923
etag: W/"8bea9e0d733d097381a1b5eb8c40983d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront)
cache-control: max-age=10800,public
date: Wed, 05 Jan 2022 00:15:14 GMT
x-amz-replication-status: FAILED
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: 8LPV3MAdDIqracZMjaqIm9IU6GrrmHqOzIR8d2MS4oZ6SKDpuevzhQ==

GET
H2 200 / Show response
www.pe.com/_static/ 230 KB
56 KB 13ms
11ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJyt0MEKwjAMBuAXsg2r0pt49TVqDTOlzYZJcY9vdlAQBA/ulOQP+Q6Bx+zyxIqsMNc+Egs0Hl3qerOMclKaGESt5i8b3xKxv3S+VvRFdvCvZ8eMi25Jrq1WbFZlS7fTOa3Y/QcqpOg+B3yx5Z34Zo8scmrHIR6GfYghxPIEe5Gd+w==

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

31a88b9695e5e8033bc8ce5c04a3a749c7bd59408f7ed6c18322f694c91a4474

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 19:57:06 GMT
server: nginx
age: 20172
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 57189

GET
H2 200 pushly-sdk.min.js Show response
cdn.p-n.io/ 298 KB
55 KB 1029ms
999ms Script
application/javascript 13.35.253.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=fkjYqXOFi7cOqgLTgon5YXK4T2wSq6RySYFr&ver=5.8.2
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-106.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28cda65e3a24af65fa7752925888d02d531955c9e29b1f4133bd72ea91c9c018

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 22:20:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: W/"15fdb5d74e7d40eca7fb784a474db1f4"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-id: mun90KNnlch6oAVT56TmvFCle4JDyd65739w22_uchk8cBIq1fCBEQ==

GET
H2 200 dfm-pushly.min.js Show response
www.pe.com/wp-content/plugins/dfm-pushly/static/js/ 160 B
207 B 12ms
12ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1641260454g

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20172
etag: "61d3a5a6-a0"
strict-transport-security: max-age=31536000;includeSubdomains
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 160
expires: Thu, 05 Jan 2023 03:00:29 GMT

GET
H2 200 script.js Show response
s033.pe.com/ 144 KB
43 KB 50ms
7ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/script.js

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

62f87a6542a6942f6ef43d1a417556df6b40d4fdbc142631ee6506805ef1ff20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:57:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 247
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 43600
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Dec 2021 18:24:50 GMT
server: -
etag: 5155f198734d1b1d7bf7ed85c6309293
content-type: text/javascript; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=600
x-amz-cf-pop: FRA56-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: sSFR5kYTTCpXLxJgnQt09UZRRy04xFzqLhRk7cMfp1DmckXsygv0zg==
expires: Wed, 05 Jan 2022 03:06:22 GMT

GET
H2 200 osano.js Show response
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/ 417 KB
100 KB 507ms
450ms Script
application/javascript 2600:9000:206f:3200:3:b7e:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:3200:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

072d1bc864528170fe2482258412b90093b58719bddbfd090d5a0217be32fd62

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
content-encoding: br
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-length: 102005
x-xss-protection: mode=block
last-modified: Thu, 16 Dec 2021 01:15:47 GMT
server: CloudFront
x-frame-options: SAMEORIGIN
etag: "eb4b4399f798babe399b9ec321710c86"
strict-transport-security: max-age=2592000
content-type: application/javascript; charset=utf-8
via: 1.1 3dd91613764eafe7ad199013ce202443.cloudfront.net (CloudFront)
cache-control: public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-id: BxNue540TdzXD8KkQLiM-JEwXD4RRbqboTPj6Jstz9cTruNzcAjaVA==

GET
H2 200 hhsl-check.min.js Show response
www.pe.com/wp-content/plugins/dfm-ad-mods/static/js/ 2 KB
852 B 15ms
15ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js?m=1641260454g

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bcc12496cca31bf3ce07009f2b035c7405081719cc9bcc534e1272649c6afd9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20172
etag: W/"61d3a5a6-882"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 801
expires: Thu, 05 Jan 2023 03:00:29 GMT

GET
H2 200 pe-logo-large.svg
www.pe.com/wp-content/uploads/2017/04/ 16 KB
5 KB 7ms
6ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/uploads/2017/04/pe-logo-large.svg

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

17e97000a009dcc5d7f0c9c5ad843306189593665fbd24f70332642d6c0f78b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-rq: hhn2 109 200 443
last-modified: Mon, 03 Apr 2017 15:41:25 GMT
server: nginx
etag: W/"8c98292806ff03a6"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=2592000
strict-transport-security: max-age=31536000;includeSubdomains
expires: Wed, 23 Nov 2022 13:41:57 GMT

GET
H2 200 modernearthy.css
www.pe.com/wp-content/themes/assets/static/css/ 366 KB
56 KB 7ms
6ms Stylesheet
text/css 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/themes/assets/static/css/modernearthy.css?ver=1641326226

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5c9683881a019f750ab90c17902b9e7e1ae02397a0b1648b466c57388c4037d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 21:09:47 GMT
server: nginx
age: 20171
etag: W/"61d4b79b-5b907"
vary: Accept-Encoding
x-cache: hit
content-type: text/css
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 57465
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 main.js
mng-pe.zeustechnology.com/ 0
50 KB 9ms
8ms Other
application/javascript 13.35.253.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mng-pe.zeustechnology.com/main.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-74.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: osX_L6pvJf.BtrG9OQyLApLYdG3swDW8
content-encoding: br
last-modified: Fri, 12 Nov 2021 18:33:35 GMT
server: AmazonS3
age: 957
etag: W/"70d9776b3c308c8caf4c17c397090e32"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
cache-control: max-age=600,s-maxage=3600
date: Wed, 05 Jan 2022 02:44:34 GMT
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: uz6gHVuza8TqYR7zdTeINe5mPxq6aR8MCEGw_d_1detnso6ZdIqaTQ==

GET
H2 200 apstag.js
c.amazon-adsystem.com/aax2/ 0
36 KB 8ms
7ms Other
application/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: qkOcdGsoDUMvfWusL4m2BAijBZa3LkSN
content-encoding: gzip
etag: 1e39d25f07f5619925357b752ab10d04
age: 582
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 1BHT330DTHNFG4J1W12G
date: Wed, 05 Jan 2022 02:50:49 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 3HWFkueRYSrbcD_RKbf3VfEyJ2yXZnfHB-scMdPSStFDMjQi6ZbSUw==

GET
H2 200 wp-emoji-release.min.js Show response
www.pe.com/wp-includes/js/ 18 KB
5 KB 7ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Wed, 10 Nov 2021 18:46:10 GMT
server: nginx
age: 4139566
etag: W/"618c1372-4705"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 4926
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 Trust-Logo-Horizontal.svg
www.pe.com/wp-content/plugins/dfm-trust-indicators/static/images/ 7 KB
3 KB 140ms
140ms Image
image/svg+xml 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 0
etag: W/"61d3a5a6-1ab8"
vary: X-Mobile-Class
x-cache: miss
content-type: image/svg+xml
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-length: 2485
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 letters-icon1.jpg
www.pe.com/wp-content/uploads/2017/05/ 45 KB
45 KB 7ms
7ms Image
image/webp 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/uploads/2017/05/letters-icon1.jpg

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

eb6a55ea38606e49f7032e06104cafae04f0367c37fe7e84259473e27abc2df1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 109 142 443
last-modified: Tue, 23 Nov 2021 13:41:57 GMT
server: nginx
etag: "79892e6b7ff53988"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-length: 45788
expires: Wed, 23 Nov 2022 13:41:57 GMT

GET
H2 200 socal-logo-sm.png
www.pe.com/wp-content/themes/wp-mason/static/images/site-logo/ 8 KB
8 KB 6ms
6ms Image
image/png 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/themes/wp-mason/static/images/site-logo/socal-logo-sm.png

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

881179ed8d76a220dc210c45af07c46373896683c0d394f1595cd7213cb4d7ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Mon, 15 Nov 2021 18:19:42 GMT
server: nginx
age: 4139444
etag: W/"6192a4be-1fcf"
strict-transport-security: max-age=31536000;includeSubdomains
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 7863
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 dfm-logo-sm.png
www.pe.com/wp-content/themes/wp-mason/static/images/site-logo/ 13 KB
13 KB 6ms
6ms Image
image/png 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/themes/wp-mason/static/images/site-logo/dfm-logo-sm.png

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3214c1d02f0794737b58d56814b31c639c67f85c6eb6816c39804cf5d4041dea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Mon, 15 Nov 2021 18:19:42 GMT
server: nginx
age: 4129993
etag: W/"6192a4be-3443"
strict-transport-security: max-age=31536000;includeSubdomains
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 12825
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 / Show response
www.pe.com/_static/ 18 KB
8 KB 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJyVzUEKwjAQQNELmY6VtDvxKFKSaZ2QTEJmUjGnlwru3Lh98PnwLMZlVmSFEttGLODXdO/YBBYRVAGpDsKHzcEmZS9DIh6CnOBHXx5ZM68UI+zIPlco5LRVPOi/MC79JdTx+7ul6zjb8TKf7WTDG88vRsE=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b6314c8400868242589514cba66862e787c8ec59275942e0417a65f821a0a976

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 01:40:54 GMT
server: nginx
age: 20171
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 8016

GET
H2 200 ads.js Show response
www.pe.com/wp-content/themes/wp-mason/static/js/ 87 B
157 B 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Mon, 15 Nov 2021 18:19:42 GMT
server: nginx
age: 4139438
etag: "6192a4be-57"
strict-transport-security: max-age=31536000;includeSubdomains
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 87
expires: Thu, 05 Jan 2023 03:00:29 GMT

GET
H2 200 / Show response
www.pe.com/_static/ 115 KB
32 KB 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/_static/??-eJydz91OwzAMBeAXIvXKxs8N4lGmLPbaZLET1Q6ob080QBrShBh31pG+YxveqwtFjMTAZmJS8KpkCmreYoCkEApzkSHMTU4DRxmS3sEfXC15Pcac9RbEBWkR8ovN6y+uJ+y1yIXMZSou8uS82XKN1tymKAp4ZOfR9U36g/fs85zbsd7LW0Qq/5C1WL/6EkYJuWF/Mp3/JD4QXivm5r67E1n14eTGzbCDfS+AQ4sZQWe/EHrE9TxGmb6KXvllfNyN2+3m4fkpfQApcb8K

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d348f499cc107421f1673e9a3a84606a3db6d4cb0ba0ad903c5f59142ede9db4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:29 GMT
x-rq: hhn2 0 4 9980
last-modified: Tue, 04 Jan 2022 21:09:47 GMT
server: nginx
age: 20171
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 32994

GET
H2 200 p.js Show response
cdn.parsely.com/keys/pe.com/ 56 KB
21 KB 33ms
7ms Script
application/javascript 65.9.7.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/pe.com/p.js?ver=2.6.1
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.60 Altamonte Springs, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-60.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 90fa0859cb41aad24ca115ac15af214660b026692c926eb00a510793f1a91f06

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Tue, 04 Jan 2022 09:24:17 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 15:22:33 GMT
server: nginx
age: 63372
etag: W/"61b21f39-df3b"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
cache-control: max-age=86400, public
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 2fOL3kXj0SwL_dno91-EA1h6BCirsL-EVw-CYzO4jdkGEJhntfzDOw==
expires: Wed, 05 Jan 2022 09:24:17 GMT

GET
H2 200 e-202201.js Show response
stats.wp.com/ 9 KB
3 KB 21ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202201.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-nc: HIT hhn
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sat, 31 Dec 2022 23:13:22 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 22ms
7ms XHR
application/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: L2_MRp8KwiUR7xIWXZFooLHRBfnaqY96
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 73007
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 22 Dec 2021 01:41:37 GMT
server: AmazonS3
date: Tue, 04 Jan 2022 06:43:43 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 7e513424eee237ee26467e8fd5656ec1.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 6Ch6tz_mPJtFF6wdjqEPE3GU3LAtExuxWDQbby5-Ni-kUTRt9KQ84A==

GET
H/1.1 200
OK SGCYZ-MP4L3-UVUWR-U6DK7-CV3SL Show response
c.go-mpulse.net/boomerang/ 205 KB
50 KB 27ms
12ms Script
application/javascript 2a02:26f0:7100:594::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/SGCYZ-MP4L3-UVUWR-U6DK7-CV3SL
Requested by: Host: www.pe.com
URL: https://www.pe.com/_static/??-eJyNjEEKwjAQRS9kOlZid+IRFHoAqelUEjKTkp8geHpbsNClq89/8B69Z+OSFtZCc6wvr6BxkseHK2gAuCzfo6zQrNA8q46Rm4AD7VwX/TJGqtkqyI7unKeUZVDHWyyAZK4R3IjX/yp9f9vZQDIlpYhf4CqXtrPtqTvasw1fLLRMnQ==
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:7100:594::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Akamai Resource Optimizer /
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:29 GMT
Content-Encoding: br
Last-Modified: Tue, 21 Dec 2021 02:09:25 GMT
Server: Akamai Resource Optimizer
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800, s-maxage=604800
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 50393

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 31ms
10ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA5) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 384
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/8FA5)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c23116b8-401e-0026-53df-01a06d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Wed, 05 Jan 2022 03:30:30 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
594 B 29ms
7ms Script
text/javascript 2a04:4e42:c00::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:c00::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dd1b5e04d54c4420fe3e8e6abe2875fc7f13a3cd6384b6c2afc1a35e302dd846

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 4337614
detected-user-agent: Chrome Mobile/96.0.4664
server-timing: HIT, fastly;desc="Edge time";dur=0, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 101
referrer-policy: origin-when-cross-origin
last-modified: Mon, 15 Nov 2021 17:04:18 GMT
date: Wed, 05 Jan 2022 03:00:30 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/96.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ 122 KB
39 KB 51ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

833af79fceebd91289eb5aac891019a7e5bd2a99f74fbd8d8430f52d6f908f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-1e6ef"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 06 Jan 2022 03:00:30 GMT

GET
H/1.1 200
OK 185707-19209563922117.js Show response
js-sec.indexww.com/ht/p/ 40 KB
14 KB 34ms
8ms Script
text/javascript 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/185707-19209563922117.js
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5f73db920d574a8ba16efc308a57e03f838227d4935e9892ec4d7403cf663517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Jan 2022 02:46:08 GMT
Server: Apache
ETag: "762320-9fd7-5d4ccc181b2fe"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=2794
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 13656
Expires: Wed, 05 Jan 2022 03:47:04 GMT

GET
H2 200 userSync.js Show response
ads.pubmatic.com/AdServer/js/ 7 KB
3 KB 45ms
7ms Script
text/javascript 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:14 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300709-1af3-5c4c7cca9e573"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: public, max-age=97018
accept-ranges: bytes
content-type: text/javascript
content-length: 2267
expires: Thu, 06 Jan 2022 05:57:28 GMT

GET
H2 200 sync.js Show response
ib.3lift.com/ 275 B
575 B 36ms
7ms Script
application/javascript 143.204.215.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/sync.js
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-88.fra53.r.cloudfront.net
Software: /
Resource Hash: c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:47:27 GMT
via: 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront)
last-modified: Wed, 05 Jan 2022 02:47:27 GMT
age: 783
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900
x-amz-cf-pop: FRA53-C1
content-length: 275
x-amz-cf-id: zrenHx1-unClygeXGWWHzqouJxZgPUqXral8ljwzuvz8QJlKCOhkZg==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 79 KB
27 KB 71ms
23ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

a39c434ed12e9707bff709c0cdb94247ab1468dbed0fd4db5250d59051c501f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27031
x-xss-protection: 0
server: sffe
etag: "1092 / 432 of 1000 / last-modified: 1641335921"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 05 Jan 2022 03:00:30 GMT

GET
H/1.1 200
OK a898643c0aee53388471995214abd2c84ec96005 Show response
insights.zeustechnology.com/www.pe.com/ 436 B
1 KB 612ms
586ms XHR
binary/octet-stream 65.9.58.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insights.zeustechnology.com/www.pe.com/a898643c0aee53388471995214abd2c84ec96005?article_location=www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-124.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b2001efa6a71924d67fcb58760986b8b6c01b865b0f94d1be43e5088b1550ffe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:31 GMT
Via: 1.1 72e8bbddfffeeec486003f867d631025.cloudfront.net (CloudFront)
Vary: Origin
X-Amz-Cf-Pop: FRA56-C1
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 436
x-amz-expiration: expiry-date="Fri, 11 Feb 2022 00:00:00 GMT", rule-id="ArticleCleanup"
Last-Modified: Sun, 12 Dec 2021 18:20:36 GMT
Server: AmazonS3
ETag: "137690a623a69ae9c34a3921615082d6"
Access-Control-Max-Age: 180
Access-Control-Allow-Methods: GET, HEAD
Content-Type: binary/octet-stream
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
X-Amz-Cf-Id: kP_OAoJ1SAEQA_I7O0Kp7zv84bmTLwowdAWU68DTJXopK7nEyVTWOg==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 755 B
1 KB 11ms
10ms XHR
application/json 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.pe.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 9455c17f04895c082b78aad0133bb5222671817dfcd4b8bfb1211746f5e5cae2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:42:50 GMT
via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
server: Server
age: 1059
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.pe.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-C1
content-length: 755
x-amz-cf-id: Y3w2AELMDXrFXQq-wkIC7pTCCE23sy3ik3-wVnNsm8bTe7QIuG17cA==

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 109 KB
37 KB 35ms
8ms Script
application/x-javascript 13.35.253.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-16.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 72c5d10e99c6620a2561415895a84064b5b5616c2b1914602263886be4cdc229

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: 28x_tDvW9kJ.rWgfbdZIcgxbFDdgh9p3
content-encoding: gzip
etag: W/"d7dfa2940a5d5ce3beedd8774c961dd7"
age: 51260
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:6fbe2bf4-0d3f-4234-a84e-c584de5ecb5e
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: 8c7650e47b7f894f6ae5a1fc4919cee6
last-modified: Thu, 16 Dec 2021 12:45:56 GMT
server: AmazonS3
date: Tue, 04 Jan 2022 12:46:11 GMT
vary: Accept-Encoding
x-amz-meta-codebuild-content-sha256: ae589a6335869a8948d0172dfafea0c42638763d87ea89591504c580a5c4f6c7
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-pop: FRA6-C1
content-type: application/x-javascript
x-amz-cf-id: N_h2H-izlVpObSNQG0cPZTecdBVnMiado1DkWtKmhNsaOp5fkshMgA==

GET
H2 200 loader-config.json Show response
loader-cdn.azureedge.net/prod/dfm/ 1011 B
843 B 63ms
9ms XHR
application/json 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1641351629417
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FD5) /
Resource Hash: 96b34914f736b96f184920bea4cf3b30a7b76583c51bf1e9caf2add39705bffd

Request headers

Accept: */*
Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
content-md5: i1fC4Ue5p2n4u48t1IbEIQ==
age: 20703
x-cache: HIT
content-length: 465
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 10:13:01 GMT
server: ECAcc (frc/8FD5)
etag: 0x8D905773626BB80
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9099e6b9-501e-009b-0cb0-01ab47000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 16 B
699 B 291ms
92ms Script
text/javascript 54.167.130.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json578

Requested by

Host: s033.pe.com
URL: https://s033.pe.com/script.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.167.130.168 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-167-130-168.compute-1.amazonaws.com

Software

- /

Resource Hash

00f88d013f389b1b1fe37b653248847565cda56cd5e7b98242e4da7666d660e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-robots-tag: noindex, nofollow
p3p: policyref="", CP="DSP"
x-permitted-cross-domain-policies: master-only
cache-control: no-cache, no-store, no-transform, must-revalidate, private
content-type: text/javascript; charset=utf-8
content-length: 36
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 16 B
697 B 291ms
93ms Script
text/javascript 54.167.130.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json579

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.167.130.168 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-167-130-168.compute-1.amazonaws.com

Software

- /

Resource Hash

24bcc5ed9bdd0c9aee18cdde9c798a4b939d9918e46d2b2ba32739e643256ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-robots-tag: noindex, nofollow
p3p: policyref="", CP="DSP"
x-permitted-cross-domain-policies: master-only
cache-control: no-cache, no-store, no-transform, must-revalidate, private
content-type: text/javascript; charset=utf-8
content-length: 36
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600%2C700%7CSource+Serif+Pro%3A400%2C700&ver=5.8.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 06:26:40 GMT
x-content-type-options: nosniff
age: 419630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7988
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:02:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 31 Dec 2022 06:26:40 GMT

GET
H2 200 bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 88 KB
89 KB 19ms
6ms Font
font/woff2 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 3031421
x-jsd-version: 1.5.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 90528
etag: W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
x-served-by: cache-fra19169-FRA
x-jsd-version-type: version
date: Wed, 05 Jan 2022 03:00:30 GMT
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

Referer
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: font/truetype

GET
BLOB 200
OK 5ac07817-7139-4570-b132-cc53ef88190c
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/5ac07817-7139-4570-b132-cc53ef88190c
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600%2C700%7CSource+Serif+Pro%3A400%2C700&ver=5.8.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 10:59:22 GMT
x-content-type-options: nosniff
age: 576068
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7832
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:01:48 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 29 Dec 2022 10:59:22 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600%2C700%7CSource+Serif+Pro%3A400%2C700&ver=5.8.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 20:12:20 GMT
x-content-type-options: nosniff
age: 24490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:02:01 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 04 Jan 2023 20:12:20 GMT

GET
H2 200 neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oA.woff2
fonts.gstatic.com/s/sourceserifpro/v11/ 19 KB
20 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v11/neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600%2C700%7CSource+Serif+Pro%3A400%2C700&ver=5.8.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97816b3ca3d676b5241a16fd6fb3f3e4050a3b99c914f0a66f0bcc074617ba80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 20:21:03 GMT
x-content-type-options: nosniff
age: 542367
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19956
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:48:47 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 29 Dec 2022 20:21:03 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ 4 KB
2 KB 29ms
15ms XHR
application/json 2a02:26f0:7100:594::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=SGCYZ-MP4L3-UVUWR-U6DK7-CV3SL&d=www.pe.com&t=5471172&v=1.720.0&sl=0&si=cbd08199-f732-4667-bf65-1ea85ae667c3-r57v0t&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/SGCYZ-MP4L3-UVUWR-U6DK7-CV3SL
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:7100:594::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 18112e3d4932e8a808f1b4031c3b9a836f866608a1fd77e1a83f124098e45f17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:30 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 1239

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 385 KB
92 KB 37ms
16ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2c39e5290ff0524d1b014847ad09d20bcdf39594d7a14fb3bf34e495bbb1a7d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93520
x-xss-protection: 0
expires: Wed, 05 Jan 2022 03:00:30 GMT

GET
H2 200 common.chunk.min.js Show response
www.pe.com/wp-content/themes/assets/static/js/ 42 KB
10 KB 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/themes/assets/static/js/common.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

dbae94cba2ba3d07d6ae6e79a7c60c4efc36deb442e193ab18e0fd0cd4d97eef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Wed, 17 Nov 2021 23:00:38 GMT
server: nginx
age: 4139564
etag: W/"61958996-a62f"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 10465
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 common-async.chunk.min.js Show response
www.pe.com/wp-content/themes/assets/static/js/ 56 KB
8 KB 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/themes/assets/static/js/common-async.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1ea03e7bb14df931f8a649756cffe9465c815aa0efc23acce14b50e21c3d20ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Wed, 17 Nov 2021 23:00:38 GMT
server: nginx
age: 4139439
etag: W/"61958996-e145"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 8377
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 modernearthy-async.chunk.min.js Show response
www.pe.com/wp-content/themes/assets/static/js/ 5 KB
2 KB 6ms
6ms Script
application/javascript 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pe.com/wp-content/themes/assets/static/js/modernearthy-async.chunk.min.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

99ff0f06144001dc0b81b59a9c58560585a9567ebde6e9f465fab855929263e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 0 4 9980
last-modified: Wed, 17 Nov 2021 23:00:38 GMT
server: nginx
age: 4139439
etag: W/"61958996-133c"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-encoding: gzip
content-length: 1492
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 / Show response
cmp.osano.com/ Frame 2769 4 KB
1 KB 7ms
7ms Document
text/html 2600:9000:206f:3200:3:b7e:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.osano.com/
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:3200:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

content-type: text/html
last-modified: Thu, 21 Oct 2021 22:01:08 GMT
x-amz-version-id: xT1PkIFehetvNf5lINcU02FbT3u47kBr
server: AmazonS3
content-encoding: gzip
date: Tue, 04 Jan 2022 20:21:46 GMT
etag: W/"287b497c992487af362d33204f87d28f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 3dd91613764eafe7ad199013ce202443.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: kTmrg5wFmiu4BlxDm_KyuUVQ0q1bTQewg_IFyv8P3Ap6XPYAXOXE6g==
age: 23925

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 6ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.4&blog=126836621&post=3346815&tz=-8&srv=www.pe.com&host=www.pe.com&ref=&fcp=1221&rand=0.5514662888516555
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 05 Jan 2022 03:00:30 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 972F 9 KB
4 KB 49ms
16ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.pe.com

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

133be2ab152b1c9f408e9a597430361539cf3b8255a0a92f8a8a8a885e079702

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1723
date: Wed, 05 Jan 2022 03:00:30 GMT
content-length: 4161
strict-transport-security: max-age=31536000; preload;

GET
H2

200

restricted Show response
mid.rkdms.com/
Redirect Chain

https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=MEDIANEWSGROUP
https://mid.rkdms.com/restricted

5 KB
2 KB

93ms
92ms

XHR
text/html

3.208.83.212
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/restricted
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Server: 3.208.83.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-83-212.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 73a5c38561a9bef102be3b7b6278721916913075bce67f4600e6ca810d74b0c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
server: nginx
access-control-allow-methods: GET, HEAD, OPTIONS
content-language: de-DE
access-control-allow-origin: https://www.pe.com
access-control-allow-credentials: true
content-type: text/html;charset=ISO-8859-1

Redirect headers

location: /restricted
date: Wed, 05 Jan 2022 03:00:30 GMT
access-control-allow-credentials: true
server: nginx
access-control-allow-origin: https://www.pe.com
content-length: 0
access-control-allow-methods: GET, HEAD, OPTIONS

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
541 B 121ms
51ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=185707
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/185707-19209563922117.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: b26c8bbdb2299a7b5b4ee088ed48e7e1c7bfc23a1a0ff351648859108b1ff982

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pe.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Fri, 04 Feb 2022 03:00:30 GMT

GET
H/1.1 200
OK any Show response
idx.liadm.com/idex/ie/ 206 B
682 B 373ms
92ms XHR
application/json 52.86.156.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/ie/any

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/185707-19209563922117.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.86.156.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-86-156-15.compute-1.amazonaws.com

Software

Resource Hash

608c710dc12ffce0ce56bb5f5731c567456cfa23b9655f0524a8d2a6f03c4f24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 05 Jan 2022 03:00:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json
Access-Control-Allow-Origin: https://www.pe.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
trace-id: 98c4a832e3c05fcf
Content-Length: 206

GET
H2 451 identity Show response
api.rlcdn.com/api/ 44 B
325 B 39ms
14ms XHR
text/plain 34.120.133.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/185707-19209563922117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

55.133.120.34.bc.googleusercontent.com

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.pe.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 44

GET
H2 200 1000-6-2.jpeg
www.pe.com/wp-content/uploads/2021/12/ 36 KB
37 KB 120ms
120ms Image
image/webp 192.0.66.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pe.com/wp-content/uploads/2021/12/1000-6-2.jpeg?w=863

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f3a8ee9d81a2ecb7d3c5026edae0d3a9cf07de5dd002c0163c6891f48edc5da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
x-rq: hhn2 109 139 443
last-modified: Wed, 05 Jan 2022 03:00:30 GMT
server: nginx
etag: "55fd01408fe65eec"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000;includeSubdomains
accept-ranges: bytes
content-length: 37268
expires: Thu, 05 Jan 2023 03:00:30 GMT

GET
H2 200 fp.min.js Show response
fp-cdn.azureedge.net/prod/dfm/ 59 KB
20 KB 60ms
9ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F4C) /
Resource Hash: 9d7ae5b7196c72a8c09f3a766e06e61b2ef1d6192076016838b479136435b678

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
content-md5: I+TRQO5bVyRNfhz04pv14Q==
age: 18698
x-cache: HIT
content-length: 19745
x-ms-lease-status: unlocked
last-modified: Thu, 24 Dec 2020 08:54:59 GMT
server: ECAcc (frc/8F4C)
etag: 0x8D8A7E997F32F60
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 373f07cc-701e-00ea-4bb4-01d97e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 g2i.min.js Show response
g2insights-cdn.azureedge.net/prod/dfm/ 1 MB
217 KB 71ms
10ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://g2insights-cdn.azureedge.net/prod/dfm/g2i.min.js?
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F49) /
Resource Hash: a7193b4a580e14658a91dd634cc0ef32ebccae115e311886a993b5e07ca5102d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
content-md5: MEV0XK+iSrlNTVyliS0EpQ==
age: 19849
x-cache: HIT
content-length: 221901
x-ms-lease-status: unlocked
last-modified: Tue, 29 Dec 2020 13:55:30 GMT
server: ECAcc (frc/8F49)
etag: 0x8D8AC0167971F78
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: bd87cf3a-701e-0026-1ab2-01bdcb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 559 KB
118 KB 68ms
10ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FC9) /
Resource Hash: ea5d2befb0a4e0ce54a1e5014b440dcbec8a981df5921805bef7c080647dab6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
content-md5: qVIPcM+g3AcDoTOKAhEK0A==
age: 22348
x-cache: HIT
content-length: 119973
x-ms-lease-status: unlocked
last-modified: Wed, 11 Aug 2021 20:38:31 GMT
server: ECAcc (frc/8FC9)
etag: 0x8D95D07FB91B69A
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: fa6231bb-f01e-005a-52ac-0120fe000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 pushly-sdk.min.css
cdn.p-n.io/ 26 KB
2 KB 11ms
10ms Stylesheet
text/css 13.35.253.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.css?domain_key=fkjYqXOFi7cOqgLTgon5YXK4T2wSq6RySYFr
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-106.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 501b84d7db37a158e0313efd545c334fc75d82750e1248fa383321c67728b1ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 22:35:39 GMT
content-encoding: gzip
last-modified: Wed, 07 Jul 2021 15:59:32 GMT
server: AmazonS3
age: 15892
etag: W/"f78fe2b0b79df0619d393cfc42450ddf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: KiOrpJbMMlJA56zaNqbPxaDvgO1UCjQfft54E9m13atTFwlbww2dSg==

GET
H3 200 pubads_impl_2021120601.js Show response
securepubads.g.doubleclick.net/gpt/ 348 KB
117 KB 32ms
18ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119476
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 09:34:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 05 Jan 2022 03:00:30 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 208 B
149 B 30ms
16ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.pe.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

e1e2c69415d3ce981eb39442df8b7ed7cab80814de7de473d486669c926fab18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124
x-xss-protection: 0
expires: Wed, 05 Jan 2022 03:00:30 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F9BC 14 KB
5 KB 8ms
8ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=CPSUmIUPSUmIUEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&gdpr=1&us_privacy=1---&
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=70503
expires: Wed, 05 Jan 2022 22:35:33 GMT
date: Wed, 05 Jan 2022 03:00:30 GMT
vary: Accept-Encoding

GET /
geo.privacymanager.io/ 0
0

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 105 KB
17 KB 471ms
470ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A30%2B00%3A00&ts=1641351630956

Requested by

Host: s033.pe.com
URL: https://s033.pe.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

fc1c59f24e8ddfd6ba5b1c98d9c1aecd31d2b2884c9ab7bed98af70c3f12dd29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 15814
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: 1wZyTcnTvVt4WmvS4yCPqDrTRrHnpTstAC2Jll1rSAeiFrFt9UsIxQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 103 B
1002 B 375ms
374ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: s033.pe.com
URL: https://s033.pe.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

bf46d5d914dccddc7da53f756e095a4357e4f0b84bdffe36f26d8d58d2d18f69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 115
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: 6K1DPWGt6UKKCUM6R3zKcNE_TqYZSJ3rRwb1ZYkhfqYbKThOoOM_Gg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 e95be28ae04bb3f5bf2c680cd31bfa74fa7ff6ac3aee80299166d3529f902985 Show response
scripts.webcontentassessor.com/scripts/ 73 KB
19 KB 634ms
604ms Script
application/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.webcontentassessor.com/scripts/e95be28ae04bb3f5bf2c680cd31bfa74fa7ff6ac3aee80299166d3529f902985
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 102ca8ad26b6f1f1a1652d9e39f40815a1cf9d9cdcf94e8ba412706097a5af79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
age: 0
x-cache: MISS
content-length: 19372
x-amz-id-2: SlAKTIQOoQZd7+vq1fVs3Iah+ydX0hpG3Rq+rv1SyGJu+cabU0NvjvoGCeE+8jtsmIaxh39MmAw=
x-served-by: cache-fra19122-FRA
last-modified: Wed, 05 Jan 2022 02:48:54 GMT
server: AmazonS3
x-timer: S1641351631.018571,VS0,VE598
etag: "a4f9c8958b626df80ee450117ccbc13f"
vary: Accept-Encoding
x-amz-request-id: WHMFY8SCG797GMQE
via: 1.1 varnish
cache-control: max-age=3600,stale-if-error=86400,stale-while-revalidate=3600
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 0

GET
H2 200 a-05gf.min.js Show response
b-code.liadm.com/ 26 KB
10 KB 36ms
9ms Script
application/javascript 2600:9000:2057:3200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-05gf.min.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:3200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ZIO-Http /
Resource Hash: bdec589d8782fb514fb6e818e16cd184f20681bb3a77155cba33f02e004bb1a4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 20:45:33 GMT
via: 1.1 b0954612f115b3d0a0db0a669e45ae8f.cloudfront.net (CloudFront)
server: ZIO-Http
age: 22498
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: FRA6-C1
content-encoding: gzip
x-amz-cf-id: WSQdh9rMKavklyfMKKSNsxZzdNIecGZAv8tjyXFvrN8fXUv9rhezwA==

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=https...
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=http...

0
223 B

12ms
12ms

Image
text/plain

13.35.253.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&c9=
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Server: 13.35.253.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-75.fra6.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id: OLiNnlR1lQZ2bsIr9HAYRkiMNhCUgApi3qCZ8U4TPpBwzhs4sFaWvg==
x-cache: Miss from cloudfront

Redirect headers

date: Wed, 05 Jan 2022 03:00:31 GMT
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1641351630977&ns_c=UTF-8&c8=As%20Clinton%20Foundation%20donations%20plunge%2C%20questions%20raised%20%E2%80%93%20Press%20Enterprise&c7=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&c9=
content-length: 321
x-amz-cf-id: Ado7e7An8jq2a3KxoW_Qe0WUKk7hgny9JtrwLSmld9Qc7sOOcKIHww==

GET
H2

200

sid Show response
mug.criteo.com/ Frame 972F
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=www.pe.com&sn=ChromeSyncframe&so=0&topUrl=www.pe.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=jY47Cnxpd1RtRVVkVE9TZldXOUVvVEdSeS9PQ09BN0puYnhydldDcldkNlI3Y0lTeFdOSXM4VUoxSDFSQnB2aC80MlhsN1BKMkRqVitoUEd3YVBvckdOUDVZT0FDWVF3S0JLY2Y0allXbFFDRFJxVVMwdmdjR0JHRFJ0ZU...

441 B
637 B

70ms
16ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=jY47Cnxpd1RtRVVkVE9TZldXOUVvVEdSeS9PQ09BN0puYnhydldDcldkNlI3Y0lTeFdOSXM4VUoxSDFSQnB2aC80MlhsN1BKMkRqVitoUEd3YVBvckdOUDVZT0FDWVF3S0JLY2Y0allXbFFDRFJxVVMwdmdjR0JHRFJ0ZUVCTzVYVkwzeDl0R1pQUXJzSnVybThlK0Vrbzg1eVpRdUU1bEhOU0dKY1EyZTlkSExMU3p5S1htaWgzeEFkQ1lTQTJSTWVBQ0xRM0s4YTFxSXZOSWNEOGYwcmtOZ0F0eG4xUHFvekR1YkpuN3o1UzZnRlBsZFAxUVJucDAxbGd5SUNsMkN2blFQQU9tRy9aVmtxZzh4S2RQelFsMjFiQT09fA&cppv=2

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.pe.com

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

60678bfba46c3541d231c87dfe3ec13b6e44813780edd999433ea13a7b443dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2390
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:30 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=jY47Cnxpd1RtRVVkVE9TZldXOUVvVEdSeS9PQ09BN0puYnhydldDcldkNlI3Y0lTeFdOSXM4VUoxSDFSQnB2aC80MlhsN1BKMkRqVitoUEd3YVBvckdOUDVZT0FDWVF3S0JLY2Y0allXbFFDRFJxVVMwdmdjR0JHRFJ0ZUVCTzVYVkwzeDl0R1pQUXJzSnVybThlK0Vrbzg1eVpRdUU1bEhOU0dKY1EyZTlkSExMU3p5S1htaWgzeEFkQ1lTQTJSTWVBQ0xRM0s4YTFxSXZOSWNEOGYwcmtOZ0F0eG4xUHFvekR1YkpuN3o1UzZnRlBsZFAxUVJucDAxbGd5SUNsMkN2blFQQU9tRy9aVmtxZzh4S2RQelFsMjFiQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2813
content-length: 541
expires: 0

GET
BLOB 200
OK c4ff4f03-eb27-44c0-96d5-c43c40fe1dc5
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/c4ff4f03-eb27-44c0-96d5-c43c40fe1dc5
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 t8y9347t.min.css
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 295 KB
28 KB 10ms
9ms Stylesheet
text/css 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.css?
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FD7) /
Resource Hash: 70c4634f438568a86bb98789e25bd251a5b979f0e1f68c57956f5c038f53a914

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
content-md5: qePO0yKWifmYWvQdlK/DtQ==
age: 22346
x-cache: HIT
content-length: 28321
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:48 GMT
server: ECAcc (frc/8FD7)
etag: 0x8D9056E3D33EB71
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: c6471d55-f01e-0133-07ac-013907000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 27 KB
11 KB 206ms
173ms XHR
application/json 185.33.221.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

5ef86c111e8a3e6208263265a005c7379b8793ef6bc5c0a2a94454a1cb2e1f83

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

Date: Wed, 05 Jan 2022 03:00:31 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d123eb93-009b-4a52-9bb8-93d118b74bfd
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.pe.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 7 KB
5 KB 85ms
41ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=117&profileId=184&cb=8199953245

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c2168fa195790fd53543640ff32c2e008ab5e3bbf3034ad87d5188b7a18e3aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pe.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4354

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 17 KB
4 KB 350ms
326ms XHR
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?ac=j&s=212590&v=7.2&sd=1&r=%7B%22id%22%3A%2245c12253-d19b-4f90-8ceb-e69cecfed4a6%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22a312b0e6-9d7a-4f0a-8bce-fda8648a49e5%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A50%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A50%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653022%22%2C%22gpid%22%3A%228013%2Fzeus_Sponsorship_1%22%7D%7D%2C%7B%22id%22%3A%22734a9846-cd8a-4e08-884f-e4e25c7d8fd0%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653023%22%2C%22gpid%22%3A%228013%2Fzeus_top_leaderboard%22%7D%7D%2C%7B%22id%22%3A%227f4ffb45-3468-4ebf-945a-420483a6c8dc%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653023%22%2C%22gpid%22%3A%228013%2Fzeus_top_leaderboard%22%7D%7D%2C%7B%22id%22%3A%2239acebc4-add8-40d1-b49f-0dd67515abcf%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653023%22%2C%22gpid%22%3A%228013%2Fzeus_top_leaderboard%22%7D%7D%2C%7B%22id%22%3A%22891c7ff8-714c-495f-aca4-4facfcb3adf8%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653024%22%2C%22gpid%22%3A%228013%2Fzeus_Cube1_RRail_ATF%22%7D%7D%2C%7B%22id%22%3A%221e58f5b4-77cc-474f-92a2-cf2f5f060abd%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653024%22%2C%22gpid%22%3A%228013%2Fzeus_Cube1_RRail_ATF%22%7D%7D%2C%7B%22id%22%3A%22ce3d8ed9-e578-4251-9903-274d07da962c%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653024%22%2C%22gpid%22%3A%228013%2Fzeus_Cube1_RRail_ATF%22%7D%7D%2C%7B%22id%22%3A%2258972c0a-bd9b-495b-a487-1133e72f6cb4%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22653024%22%2C%22gpid%22%3A%228013%2Fzeus_Cube1_RRail_ATF%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F%22%2C%22ref%22%3A%22%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228b02bfed-0a8b-4e0b-b2be-8e2dcfde6898%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222022-01-05T03%3A00%3A30%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%2C%7B%7D%2C%7B%7D%2C%7B%7D%5D%7D%7D
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 65da1116892245cea4c6a78ffdb5996468908b01050f06611d0be4dd33c0634e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[DE], RC:[HE], CN:[EU], CIP:[91.199.118.73], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.pe.com
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 4134
x-ak-client-geo: 12
expires: Wed, 05 Jan 2022 03:00:31 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
113 B 54ms
12ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=zeus_client
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.pe.com
date: Wed, 05 Jan 2022 03:00:29 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
3 KB 170ms
89ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=368518&tk_flint=custom&slots=3&size_id=44%3B2%3B15&alt_size_ids=%3B55%2C57%3B9%2C10%2C54&zone_id=2008082%3B2008074%3B2008096&rp_floor=0.01&us_privacy=1---
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 5467e6d4fe4a88734e7946a3c6d94952cc1be7ef30b29030b9de45e6fae48e41

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.pe.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 472
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 4 KB
2 KB 255ms
234ms XHR
application/json 18.195.229.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=zeus&v=1&referrer=www.pe.com&debug=false&us_privacy=1---

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.195.229.145 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-229-145.eu-central-1.compute.amazonaws.com

Software

Resource Hash

5ccbc882909280f350f1022342522cf327123c38f11d3124e894afbaf1deebbb

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pe.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 2070
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
530 B 41ms
41ms XHR
text/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&pid=qgR05K9wA9Dyt&cb=0&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22zeus_Sponsorship_1%22%2C%22s%22%3A%5B%22300x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fpe.com%2Fopinion%2FSponsorship_1%22%7D%2C%7B%22sd%22%3A%22zeus_interstitial%22%2C%22s%22%3A%5B%221x1%22%5D%2C%22sn%22%3A%22%2F8013%2Fpe.com%2Fopinion%2Finterstitial%22%7D%2C%7B%22sd%22%3A%22zeus_top_leaderboard%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fpe.com%2Fopinion%2Ftop_leaderboard%22%7D%2C%7B%22sd%22%3A%22zeus_Cube1_RRail_ATF%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fpe.com%2Fopinion%2FCube1_RRail_ATF%22%7D%5D&gdpre=1&gdprc=CPSUmIXPSUmIXEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.71.173 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-71-173.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C1
x-amz-rid: CT3J8CPRA7EJK6EKQEQY
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.pe.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 64
x-amz-cf-id: eYy4l8WKITkB8HkITUj1sSh7vbprDFnrFbhJhGnpbJMeuHnyLnn7GA==

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame F9BC 0
42 B 76ms
18ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=47300527&p=160200&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=CPSUmIUPSUmIUEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=CPSUmIUPSUmIUEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&gdpr=1&us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-length: 0

GET
H/1.1 200
OK SCNGPRODWP Show response
prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/ 1 MB
321 KB 231ms
230ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/SCNGPRODWP
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: 69757be46f78d6c68d065feb5f72b9c4b4ac5370dea092873aad78c8ff8eaaf6

Request headers

source-system: Plugin
site-code: DFM
autoqa: false
Accept-Language: de-DE,de;q=0.9
settingskey: LANG,PE
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE2NDEzNjYwMzF9.TivBsGja4ucuZZ1V3DzKXuGEtcahwrg4QFbw76jLroM
environment: prod
config-code: SCNGPRODWP
access-control-allow-origin: *
ssid: 28cc29c47d69f6bd1b4eb5fc44b62444
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
accept: application/json
content-type: application/json
location: undefined
attr: PE
Referer: https://www.pe.com/
version: Version: 2.5.4.3_swg

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
Content-Encoding: gzip
Expires: -1
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time,Request-Context
Cache-Control: no-cache
Content-Length: 328070
X-Server-Time: 1/5/2022 3:00:31 AM
Request-Context: appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 406ms
118ms Image
image/jpeg 52.217.105.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.105.36 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:32 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: WHM3CRCR26XXVXZD
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: yWhVNOIPI4tYp30FutgLFHjZUq+EcH0lXHfZgaFDBSLUHlgM0QjNVu67Gaxf9K3Cgfl/uHmT3KM=
x-amz-meta-s3b-last-modified: 20191015T134358Z

OPTIONS
H/1.1 200
OK SCNGPRODWP
prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/ Frame 0
0 653ms
134ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/SCNGPRODWP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Origin: https://www.pe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
X-Powered-By: ASP.NET
Date: Wed, 05 Jan 2022 03:00:31 GMT
Content-Length: 0

GET
H2 200 pixels Show response
ssp-sync.criteo.com/user-sync/ 685 B
770 B 54ms
15ms XHR
application/json 178.250.2.83
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssp-sync.criteo.com/user-sync/pixels?countrycode=DE

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.83 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f2d9a53e91a8981e54ce5e3372aef2905f9a7b2789f30bb28f212198a637f997

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pe.com
cache-control: no-store,max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;

POST
H2 204 events
bidder.criteo.com/csm/ 0
211 B 15ms
15ms Ping
text/plain 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 05 Jan 2022 03:00:30 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://www.pe.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

GET
BLOB 200
OK 717b177b-11c4-4a85-8265-82975c070b14
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/717b177b-11c4-4a85-8265-82975c070b14
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
424 B 25ms
9ms XHR
text/plain 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=212590&u=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&v=3
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[91.199.118.73], XFF:[]
Server: Apache
Access-Control-Allow-Origin: https://www.pe.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-AK-CLIENT-GEO: 12
Expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 7165
date: Wed, 05 Jan 2022 01:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 05 Jan 2022 03:01:06 GMT

GET
H/1.1 200
OK cri
match.prod.bidr.io/cookie-sync/ 43 B
430 B 136ms
32ms Image
image/gif 52.210.199.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/cri?r=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3didLraF96Rkd1aEM5cDduUmMxcTRCcDVseTglMkJvczdFejRqbSUyQmdLZVpnRWY5VmRKbyUzRA%26u%3d%24%7bUSER_ID%7d&gdpr=false&consent=&ccpa=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.210.199.144 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-210-199-144.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-7Q29Jt9d4ntK5iqR4TtMCSk...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&gdpr=false&gdpr_consent=&us_privacy=&cr_user_id=k-7Q29Jt9d4ntK5iqR4...
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=criteo
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=criteo
https://x.bidswitch.net/sync?dsp_id=70&user_id=4721132336764932446&ssp=criteo
https://ssp-sync.criteo.com/user-sync/match?p=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&u=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

0
141 B

15ms
15ms

Image
text/plain

178.250.2.83
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&u=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Server

178.250.2.83 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
cache-control: no-store,max-age=0
cross-origin-resource-policy: cross-origin
server: Kestrel
strict-transport-security: max-age=31536000; preload;

Redirect headers

Location: //ssp-sync.criteo.com/user-sync/match?p=gEMoSV9ZRlBGUGlkTWtrTG1JVlk5VlFaV3dmTTJ2SjdDS2ROdmV1eVglMkY3aEdHQjglM0Q&u=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
Date: Wed, 05 Jan 2022 03:00:31 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 cm
sync.taboola.com/sg/criteoscod/1/ 43 B
312 B 80ms
13ms Image
image/gif 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/criteoscod/1/cm?redirect=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dOFTDk180NVMyMmVxZWlWTTNIbTJPNG5DUEtQV2ZaRHhYNTlHNG5rUVhtMUU3amEwJTNE%26u%3d%3cTUID%3e&gdpr=false&consent=&ccpa=
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
cache-control: no-cache, no-store
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 7521

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 184 KB
57 KB 40ms
26ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d607276921f83d94b7a664e718fb8f540ce38b028ec4aab9926df5ea97330bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57911
x-xss-protection: 0
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H2 200 ads Show response
pagead2.googlesyndication.com/gampad/ 36 KB
10 KB 157ms
121ms XHR
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?gdfp_req=1&pvsid=3627211029570095&correlator=486530773918242&output=ldjh&impl=fifs&vrg=2021120601&ptt=17&gdpr_consent=CPSUmIaPSUmIaEXABADEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&gdpr=1&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20220105&iu_parts=8013%2Cpe.com%2Copinion%2CSponsorship_1%2Cinterstitial%2Ctop_leaderboard%2CCube1_RRail_ATF&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4%2C%2F0%2F1%2F2%2F5%2C%2F0%2F1%2F2%2F6&prev_iu_szs=300x50%2C1x1%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%7C300x1050%7C160x600&prev_scp=POS%3DSponsorship_1%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Sponsorship_1.init.dsk%26amznbid%3D2%26amznp%3D2%26crt_pb%3D0.01%26crt_bidid%3Dzrjdpa%7CPOS%3Dinterstitial%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_interstitial.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3Dtop_leaderboard%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_top_leaderboard.init.dsk%26amznbid%3D2%26amznp%3D2%26crt_pb%3D0.04%26crt_bidid%3Dlgvgyr%26zeus_triplelift%3D24%26zeus_auctionid_triplelift%3De016ef06-fe1e-41ea-8e43-92aa9ae6f6e5%26zeus_appnexus%3D25%26zeus_auctionid_appnexus%3D1666870873208038030%7CPOS%3DCube1_RRail_ATF%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube1_RRail_ATF.init.dsk%26amznbid%3D2%26amznp%3D2%26crt_pb%3D0.03%26crt_bidid%3Dracsvc%26zeus_appnexus%3D2%26zeus_auctionid_appnexus%3D2053470831621568859%26zeus_ix%3D11%26zeus_auctionid_ix%3D891c7ff8-714c-495f-aca4-4facfcb3adf8&eri=1&cust_params=zeus%3Dapplied%26zeus_8013%3Dwww.pe.com%26kv%3Dopinion%252Copinion-columns%252Csusan-shelley%26page%3Darticle%26content%3D%26RPN%3D203103225323%26rurl%3D%26articleid%3D3346815%26zeus_insights%3Deiy%252Cm1p%252Cpnm%252C2ng%252C3bu%252Ckiv%252C4ss%252C8jo%252C1da%252C51y%252Cqa3%252Cbs0&bc=31&abxe=1&lmt=1641351631&dt=1641351631438&dlt=1641351629321&idt=1727&frm=20&biw=1600&bih=1200&oid=2&adxs=1290%2C160%2C800%2C1287&adys=17%2C177%2C303%2C657&adks=2618955024%2C4115865765%2C1406879670%2C2963075417&ucis=1%7C2%7C3%7C4&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x50%7C1x1%7C1280x250%7C304x600&msz=1x0%7C1x0%7C1x0%7C1x0&ga_vid=341464059.1641351631&ga_sid=1641351631&ga_hid=552468008&ga_fc=false&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&btvi=0%7C0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b33d2430f45c3b1a26c31d1363740f0ffc5d05de3f531be8bf8a805cc46b6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9306
x-xss-protection: 0
google-lineitem-id: -2,-2,5543122998,5632865904
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,138331528424,138341683323
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.pe.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C2DF 6 KB
4 KB 63ms
14ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 05 Jan 2022 03:00:31 GMT
expires: Thu, 05 Jan 2023 03:00:31 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 08de62c8b6ae5d71337715b6e125d396 Show response
s033.pe.com/plugin/plugin/ 385 KB
74 KB 8ms
7ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/plugin/plugin/08de62c8b6ae5d71337715b6e125d396

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

7e3956138b4cca652bb3eda57d0f23d88a9038527421a120e6a536e75d7f895b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 22 Dec 2021 08:36:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 1189420
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 75307
x-xss-protection: 1; mode=block
last-modified: Tue, 21 Dec 2021 08:36:51 GMT
server: -
etag: 08de62c8b6ae5d71337715b6e125d396
content-type: text/javascript; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: FRA56-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: a_rqJyxFr__dIKJiMcJa3uI0KGc_bEsX88ZzMBPR1zUTEwkKFFSL_Q==
expires: Thu, 22 Dec 2022 08:36:51 GMT

GET
BLOB 200
OK 1937d964-12ce-4ba3-8950-3b855f0447b8
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/1937d964-12ce-4ba3-8950-3b855f0447b8
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 02da9062364ab9d0415d3e3312a53442 Show response
s033.pe.com/plugin/library/ 655 KB
188 KB 8ms
7ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/plugin/library/02da9062364ab9d0415d3e3312a53442

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

acaafa483082b15ca0cb2d8a12867951880242e7ec0ea53b17843bd06d968c24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 22 Dec 2021 08:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 1189419
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 191634
x-xss-protection: 1; mode=block
last-modified: Tue, 21 Dec 2021 08:36:52 GMT
server: -
etag: 02da9062364ab9d0415d3e3312a53442
content-type: text/javascript; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: FRA56-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: 2GWz5LDUNsy-FRo6570_qY0gHVr_ftjXEH9LS48YsTYHbCNjo-Hq7w==
expires: Thu, 22 Dec 2022 08:36:52 GMT

POST
H2 200 LB-Zone-1 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/577/ 3 KB
2 KB 380ms
380ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577/LB-Zone-1?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A31%2B00%3A00&ts=1641351631526

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

1cbc9bb25cf947ca1d54788a362c925bc377e4e7f283b73377ef5b2215e74773

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 1147
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: 9zHCnBsR3vqmDCNo2SYgD6kHU_jdZdiAmiZBF7p4plwa0Xc84V8FTg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
884 B 21ms
7ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:37:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1359
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 05 Jan 2022 03:37:52 GMT

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4CC9 0
0 56ms
41ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvVYr-7DI2kp9bW03cSneFsjG5WllYD5SSvn4zcQV6Nn-5-jRR-PcMJzm8eFLvXWdeuY3bR7h96wBgjiT4z0Z1IqFIT5OeNMFkL8gh-k4sAEmCSK2a7ajdLWkZ9Jsn2rM15BR5vQt9iMJbwmYembyaA6iLF_VXDP1P77CYg0gCsGuIdLBKJ6FHijdkJwvpWQezQnShJ_caNV25nl388WfeDCyUWsswSp7NrRkzVS-lpC-zCKtVEJ2fmcZXV9VXr2DeFo25o-ZBue2lm1mm79M-rC3r2GtqzwBoK5Zki4MTjWCUweenM9V-Ty8R2HlmOZUFwqk58&sig=Cg0ArKJSzPmDBkRG_FC5EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 3D0E 13 KB
5 KB 30ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 04 Jan 2022 04:09:13 GMT
expires: Wed, 05 Jan 2022 04:09:13 GMT
content-type: text/html; charset=UTF-8
etag: 12223946614886178233
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
age: 82278
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 4CC9 13 KB
6 KB 32ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4f31178f3fe6003e606295047fdb9be890c6a9c6c8594576435f86975af582f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:39:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1257
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5713
x-xss-protection: 0
server: cafe
etag: 4841097009533305096
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 05 Jan 2022 03:39:34 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/222/ Frame 4CC9 85 KB
29 KB 46ms
14ms Script
application/x-javascript 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/222/trk.js
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Dec 2021 10:40:55 GMT
Server: AkamaiNetStorage
ETag: "27a82a9a755fe85e7882d2ba1e990a11:1639478455.565772"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29209
Expires: Thu, 05 Jan 2023 03:00:31 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 4CC9 0
803 B 47ms
13ms Image
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.pe.com%252F2021%252F12%252F12%252Fas-clinton-foundation-donations-plunge-questions-raised%252F&e=wqT_3QK8Bug8AwAAAwDWAAUBCM-T1I4GEI7FiuCkx_qQFxgAKjYJbHwm--dp0j8RiESIyDw00D8ZAAAAgOtRJ0AhiA0SACkRJMgxAAAAQOF6_D8wmYSXCjj8SEDlHkhlUK2iyyVY_KldYABojIJ3eIjuA4ABAYoBA1VTRJIFBvCamAHKB6AB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgApWgSOoCVmh0dHBzOi8vd3d3LnBlLmNvbS8yMDIxLzEyLzEyL2FzLWNsaW50b24tZm91bmRhdGlvbi1kb25hdGlvbnMtcGx1bmdlLXF1ZXN0aW9ucy1yYWlzZWQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWgNbExwYWdlYWQyLmdvb2dsZXN5bmRpYwVaAC4BfwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQUVlV3J4ZDhtTlo3S2wyc3lOWnlNbXpBbC1MQW5CYWQ2QTVaNklEY1JFbF9kNk9mTDdmQXpybTVRN0lsaEtUa3JIU1RmdVRvQnJOdGRVZ1o0emV5Y1Q4N2R2WVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTY2Njg3MDg3MzIwODAzODAzMCIINzg4Mjc4MjEqBDM5NDE6ATDAA6wCyAMA2AOxBuADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA05MS4xOTkuMTE4LjczqAQAsgQQCAAQARjKByD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8AStossliAUBmAUAoAWp8Omj8ciJ2yHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAEzLPA_0AbujwHaBhYKEAEQLgEAoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHEQgAASlMKgQxLS0tOMAGQAHIB4juA9IHDQkRTQEgCNoHBgkpROAHAOoHAggA8AeZiwOKCAIQAA..&s=32e83dc1a8eae33494ecb1af0b2e9e82c5723422

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d780d570-389a-4fb1-8bbb-108a9bcc0fe3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4CC9 0
20 B 51ms
39ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-DSSKkcVdhsjFhC12_M7fPkxqv6SAo56nLJ9FHK3TwPuTdXklJ0rcw8Wy4BNUSq_w6S1icGIGt9L37Tisw0nJ4KEtHXEA

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4CC9 119 KB
37 KB 71ms
19ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 99F4 0
0 55ms
47ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjstDM8JcZfvZp2aBKZNGMZFeqPhAhkbxSHcZOLXoss4RnvV9QzNZpfwaZYLEJ7JU7wU_bd1DqKuGHSJvihKrLE0VW_5gA_BosQI3knc0faCecGq2tdK4T4Mug_gqBVVPB7iafAvKhM_6ZnwdShM2fA-yVNL5kuct1SQwV3o8ISwHqOV-tuudkajA0uJ3s5syI0iboZggQ5-5rNEzniG0McVTwNDuGxKGq7n97SDf6DQc2GOzbxEMV2vp0L85rWESjPACniOFP1lwMHRUU-y6OxqOzHCfLvfNMhsQK3eIcA25onHxNycyHL9UkFvPd-mLINJPlQQ&sig=Cg0ArKJSzPjbYMDhvF68EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK ifnotify Show response
a2130.casalemedia.com/ Frame 67C2 39 B
286 B 34ms
12ms Document
text/html 185.170.60.161
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://a2130.casalemedia.com/ifnotify?consent=0&c=17B91C4&r=163DD010&t=61D509CF&u=X19RLU1NMTJGZS1JN3dFS0xrMUFtckVV&m=9d12270b2deb277effd502063db6ff8d&wp=E&aid=5c8b7412-332a-c26d-3f85-49a9cf9f17b3&tid=13B54&s=33E6E&cp=0.14&n=www.pe.com&pr=xx&sid=f774&epr=45c12253-d19b-4f90-8ceb-e69cecfed4a6
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.170.60.161 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

Date: Wed, 05 Jan 2022 03:00:31 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: 0
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 99F4 9 KB
5 KB 53ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:40:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4486
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:29:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:40:59 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame 99F4 27 KB
9 KB 36ms
8ms Script
text/javascript 13.35.253.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=r9vak6v_5llqzru_wwgxhbhm&c=tradedesk01cont1&js=pmw0&w=300&h=600&sid=0
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-42.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 8868b36a770f59e31cc285b79ec2cc7bf648bd03a8fba7891c3119431c165d57

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 02:14:10 GMT
content-encoding: gzip
server: nginx
age: 2781
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: CXxDJ4n5eyPH2JQTJy3VlZgEnqq169Kq3i15VE7gKEXePq7XEfAL1A==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/thetradedeskv275874568748/ Frame 99F4 327 KB
111 KB 24ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 43e37155805baaf45211de262abb39e0d274cc05229d9ffddac34d72852550ed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 16:37:52 GMT
server: AmazonS3
x-amz-request-id: G85DRZRTP5RN69FP
etag: "1c2dd799f3d42da7d9ac58c80982ac35"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=35977
accept-ranges: bytes
content-length: 112680
x-amz-id-2: 5Z3TdzH37WALIS/cQREuCBI7aj1yXhxRFzXiExn/92hZKZ0Y6hELQ76ONChUEUnc+6jX/mCHyrI=

GET
H/1.1 200
OK casale
ie1-bid.adsrvr.org/bid/feedback/ Frame 99F4 807 B
1 KB 103ms
31ms Image
image/gif 52.223.4.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ie1-bid.adsrvr.org/bid/feedback/casale?t=1&iid=cd362a7a-d49a-4c98-b2f3-96468e9b24ee&crid=wwgxhbhm&wp=YdUJzwAAAAAwYFZkcAQaCRyeY209iE-oyGr3Pw&aid=1&wpc=USD&sfe=140c89cf&puid=&tdid=00000000-0000-0000-0000-000000000000&pid=vko50on&ag=5llqzru&adv=kywm6zw&sig=1MxmU8YpnpDYoDMO-zuxtEc53Fm4Aqqk6UJhp4rVGwHY.&bp=0.1523495689071435&cf=2909522&fq=0&td_s=www.pe.com&rcats=gce&mcat=&mste=&mfld=2&mssi=&mfsi=&uhow=76&agsa=&rgz=60313&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=de&mlang=&svpid=185707&did=&rcxt=Other&lat=50.110000&lon=8.680000&tmpc=5.87&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgdHZXJtYW55EgVIZXNzZRoAIhFGcmFua2Z1cnQgYW0gTWFpbjgBUAGAAQCIAQGQAQA.&dur=CjAKDGNoYXJnZS1hbGwtMSIgCP___________wESE3R0ZF9kYXRhX2V4Y2x1c2lvbnMKSAohY2hhcmdlLWFsbE1vYXRWaWV3YWJpbGl0eVRyYWNraW5nIiMIpf__________ARIObW9hdC1yZXBvcnRpbmcqBgigjQYYDA..&durs=AuzKvO&crrelr=&pcm=1&grdc=CAE.&vc=2&said=5c8b7412-332a-c26d-3f85-49a9cf9f17b3&ict=Unknown&auct=1&im=1&mc=9df97d30-c10e-47ff-86ff-25786f6ed425
Requested by: Host: mng-pe.zeustechnology.com
URL: https://mng-pe.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.223.4.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac9557e2e67bd8033.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
server: Kestrel
transfer-encoding: chunked
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
cache-control: must-revalidate, no-cache
connection: close
content-type: image/gif

GET
H2

200

v2
odr.mookie1.com/t/ Frame 99F4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=mookie-ps&ttd_tpi=1
https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898&gdpr=1&gdpr_consent=

43 B
324 B

49ms
19ms

Image
image/gif

34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898&gdpr=1&gdpr_consent=
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H2
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:31 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898&gdpr=1&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 259

GET
H3

200

v4
metrics.getrockerbox.com/track/ Frame 99F4
Redirect Chain

https://metrics.getrockerbox.com/track/v4?source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm
https://secure.adnxs.com/getuid?https%3A%2F%2Fmetrics.getrockerbox.com%2Ftrack%2Fv4%3Fuid%3D%24UID%26source%3Dweight_watchers_subscription_germany%26tier_one%3Dttd-display%26tier_two%3Dr9vak6v%26ti...
https://metrics.getrockerbox.com/track/v4?uid=4042104120816151112&source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm&uid_ts=1641...

44 B
662 B

130ms
113ms

Image
image/gif

172.67.177.215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://metrics.getrockerbox.com/track/v4?uid=4042104120816151112&source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm&uid_ts=1641351631
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: H3
Server: 172.67.177.215 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vSnKX%2FAAARtqRLWkofDR8JSTSOtMh3Im2Mu11nwa11cChyMEEXVTcvIu3GHGCuR59BiZCpt0M%2BQAqhoKJ%2BZXhW0Lr0D6hvdYP4JnfSwsaOIF7KdD%2BTYk7eP9tuXqDc0qHaXWPhf1crHJUtA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cf-ray: 6c8974f4b9d94160-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: dc7b04ba-543e-4762-9fe6-262c8b067683
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://metrics.getrockerbox.com/track/v4?uid=4042104120816151112&source=weight_watchers_subscription_germany&tier_one=ttd-display&tier_two=r9vak6v&tier_three=5llqzru&tier_four=wwgxhbhm&uid_ts=1641351631
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 99F4 119 KB
37 KB 76ms
31ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
BLOB 200
OK 16568cd2-c0bf-469f-98c6-d9150b4d1d0d
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/16568cd2-c0bf-469f-98c6-d9150b4d1d0d
Requested by: Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4CC9 73 KB
28 KB 29ms
21ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8576ac4fad8d6a2eef6c1a412387cb3e7a6909b0a647f33bb0686d57d300d02e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28114
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461277931444"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H/1.1 200
OK rd_log Show response
ams1-ib.adnxs.com/ Frame 4CC9 0
803 B 15ms
13ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&e=wqT_3QKoBHwoAgAAAwDWAAUBCM-T1I4GEKigsdz50vPYTRgAKjYJAA0BABENCCgAGQAAAIDC9RBAIRESACkRCfRpATEAAACgmZnxPzCYhJcKOPxIQPxISABQAFj8qV1gAGiMgnd4iO4DgAEBigEAkgEDVVNEmAGsAqABMqgBAbABALgBAMABAMgBANABANgBAOABAPABANgCAOAClaBI6gJWaHR0cHM6Ly93d3cucGUuY29tLzIwMjEvMTIvMTIvYXMtY2xpbnRvbi1mb3VuZGF0aW9uLWRvbmF0aW9ucy1wbHVuZ2UtcXVlc3Rpb25zLXJhaXNlZC-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2AOxBuADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA05MS4xOTkuMTE4LjczqAQAsgQPCAAQARisAiAyKAAwADgCuAQAwAQAyAQA2gQCCADgBADwBACIBQGYBQCgBQDABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUA8AUA-gUECAAQAJAGAJgGALgGAMEGAAAAJXIQ2gYWChAFCh0BYBAAGADgBgDyBgIIAIAHAYgHAKAHALoHEQgFGkgqBDEtLS04wAZAAcgHiO4D0gcNNeIBOgjaBwYJKUTgBwDqBwIIAPAHmYsDiggCEAA.&s=fc44e06435857acf9a302666dd1a09da382d5565&bdref=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F,https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 25098382-7b04-485c-be2e-b2d0408bbae3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 impl_v81.js Show response
www.googletagservices.com/dcm/ Frame 99F4 41 KB
17 KB 22ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v81.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 15:41:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386371
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17189
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:28:15 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 31 Dec 2022 15:41:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 3D0E 101 KB
34 KB 69ms
55ms XHR
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8eef13347d64e2477c4e752050f29eadf8394eb260d67307240a44bece27d654

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34546
x-xss-protection: 0

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 4CC9 0
820 B 14ms
13ms Ping
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&e=wqT_3QK8Bug8AwAAAwDWAAUBCM-T1I4GEI7FiuCkx_qQFxgAKjYJbHwm--dp0j8RiESIyDw00D8ZAAAAgOtRJ0AhiA0SACkRJMgxAAAAQOF6_D8wmYSXCjj8SEDlHkhlUK2iyyVY_KldYABojIJ3eIjuA4ABAYoBA1VTRJIFBvCamAHKB6AB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgApWgSOoCVmh0dHBzOi8vd3d3LnBlLmNvbS8yMDIxLzEyLzEyL2FzLWNsaW50b24tZm91bmRhdGlvbi1kb25hdGlvbnMtcGx1bmdlLXF1ZXN0aW9ucy1yYWlzZWQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWgNbExwYWdlYWQyLmdvb2dsZXN5bmRpYwVaAC4BfwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQUVlV3J4ZDhtTlo3S2wyc3lOWnlNbXpBbC1MQW5CYWQ2QTVaNklEY1JFbF9kNk9mTDdmQXpybTVRN0lsaEtUa3JIU1RmdVRvQnJOdGRVZ1o0emV5Y1Q4N2R2WVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTY2Njg3MDg3MzIwODAzODAzMCIINzg4Mjc4MjEqBDM5NDE6ATDAA6wCyAMA2AOxBuADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA05MS4xOTkuMTE4LjczqAQAsgQQCAAQARjKByD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8AStossliAUBmAUAoAWp8Omj8ciJ2yHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAEzLPA_0AbujwHaBhYKEAEQLgEAoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHEQgAASlMKgQxLS0tOMAGQAHIB4juA9IHDQkRTQEgCNoHBgkpROAHAOoHAggA8AeZiwOKCAIQAA..&s=32e83dc1a8eae33494ecb1af0b2e9e82c5723422&type=nv&nvt=5&jm=1003&px=315&py=178&bw=970&bh=250&sid=6643957101815058155&vd=ct~0|rr~0&sv=222&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=21348889&sw=1600&sh=1200&pw=1610&ph=5622&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:31 GMT
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2d9f193e-bb43-4717-aaef-d95912ef6398
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.pe.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync-container.js Show response
b-code.liadm.com/ 6 KB
3 KB 7ms
7ms Script
application/javascript 2600:9000:2057:3200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/sync-container.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:3200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 07 Dec 2021 03:08:30 GMT
content-encoding: gzip
last-modified: Wed, 02 Jun 2021 16:15:01 GMT
server: AmazonS3
age: 2505122
etag: W/"ae5e94de938b0387eda6df8f20da811a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: CQKQeFXs_ero.dSxGj8yyrCkT6TzPcRS
via: 1.1 b0954612f115b3d0a0db0a669e45ae8f.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
content-type: application/javascript
x-amz-cf-id: Am7Nbndr9USPL0Ri1LVNdMxsVqD7-OCm0JdXA48CDYWDsPX7rYPHPw==

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4CC9 0
0 55ms
40ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsu5u6Q9VZ3GbVrSK8sAjSQHsLalfUKfPjM3Hg04ie5UQpI_cZX1mOlQbySTnUIykVKzFJFpJ8JxJhrVmLuj-Kk7GfsBk_RR9cYQHmMtIQkPkihgw_iZKoF1SvogRQOENQQ3G2RCBUkzOrLTUqAkwK_K6hCLOWX8P_Y0yApVx0uA3QC51NihhsSf0Q5z5F182wB1pNVjHPb3infRLr0pf48Dhqj8lCOJSvZEyYFlLENcyeyMaBN1jetYgVXArK9H9JDeLPCpBaVNkpriQ8jmUBo9IHQ-3v8VrF2HHXGxilFkT_j24x3AiKrvcyprfLjuKFWiOvQG79o&sig=Cg0ArKJSzGmMJSEUCLNCEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 4CC9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5228ae8831708ab64be7336bc43ad5212731e82d78959f87768cf7343ef17056

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 99F4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d29ba8261f9c7f72b9d0eb745cf51e0efea0697a37b99107921eeb26e5dbd844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations...
https://rp4.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donation...

39 B
595 B

423ms
93ms

XHR
application/json

52.5.181.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&ext_ixwrapperliveintentip=%7B%22t%22%3A1641351631147%2C%22d%22%3A%7B%22response%22%3A%22match%22%2C%22version%22%3A%221.1.1%22%2C%22data%22%3A%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22efk18l7o%2BI%2FpASPUR8sB1mKaTxWNStxReRTndgZDnT0bd6W%2FgzMMos8BSEAm4pjSEG6I2nf2OVNnunhUdQ99BLhJrrSCLvH95N1caNYlBx8Y23dwi6c5CNFgRSBVI0qLykmgj%2BkylQuS5jDWbhBkKldUwUyL19YJ5IYUrOIIn5Y%3D%22%2C%22ext%22%3A%7B%22keyID%22%3A13%2C%22rtiPartner%22%3A%22LDID%22%2C%22enc%22%3A1%7D%7D%5D%7D%7D%2C%22e%22%3A1641610831147%7D&us_privacy=1---&wpn=lc-bundle&gdpr=1&gdpr_consent=CPSUmIdPSUmIdEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&c=PHRpdGxlPkFzIENsaW50b24gRm91bmRhdGlvbiBkb25hdGlvbnMgcGx1bmdlLCBxdWVzdGlvbnMgcmFpc2VkIOKAkyBQcmVzcyBFbnRlcnByaXNlPC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZXNlbiBEaWFsb2c8IS0tLS0-PC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZSBDb29raWUtRWluc3RlbGx1bmdlbjwhLS0tLT48L3RpdGxlPjxoMSBjbGFzcz0iZW50cnktdGl0bGUiPgoKCQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBtZXRlcmVkIj4KCQkJQXMgQ2xpbnRvbiBGb3VuZGF0aW9uIGRvbmF0aW9ucyBwbHVuZ2UsIHF1ZXN0aW9ucyByYWlzZWQJCTwvc3Bhbj4KCgkKCTwvaDE-&i6=MmEwZjo5NDQxOjU6MDplNTo6MQ%3D%3D

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Server

52.5.181.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-5-181-6.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

070df208d93f1efa73b5a3827c22257f4d0d9b53e8c425a699a4c5e82a75411e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
x-pixel-event-id: 16193d5f-f4ed-4f15-849d-e3c3ce0f2a8c
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
request-time: 1
vary: Origin
content-length: 39
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: 2058390214bd1828

Redirect headers

date: Wed, 05 Jan 2022 03:00:32 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1641351631888&aid=a-05gf&se=e30&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&tna=v2.3.0&pu=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&ext_ixwrapperliveintentip=%7B%22t%22%3A1641351631147%2C%22d%22%3A%7B%22response%22%3A%22match%22%2C%22version%22%3A%221.1.1%22%2C%22data%22%3A%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22efk18l7o%2BI%2FpASPUR8sB1mKaTxWNStxReRTndgZDnT0bd6W%2FgzMMos8BSEAm4pjSEG6I2nf2OVNnunhUdQ99BLhJrrSCLvH95N1caNYlBx8Y23dwi6c5CNFgRSBVI0qLykmgj%2BkylQuS5jDWbhBkKldUwUyL19YJ5IYUrOIIn5Y%3D%22%2C%22ext%22%3A%7B%22keyID%22%3A13%2C%22rtiPartner%22%3A%22LDID%22%2C%22enc%22%3A1%7D%7D%5D%7D%7D%2C%22e%22%3A1641610831147%7D&us_privacy=1---&wpn=lc-bundle&gdpr=1&gdpr_consent=CPSUmIdPSUmIdEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA&c=PHRpdGxlPkFzIENsaW50b24gRm91bmRhdGlvbiBkb25hdGlvbnMgcGx1bmdlLCBxdWVzdGlvbnMgcmFpc2VkIOKAkyBQcmVzcyBFbnRlcnByaXNlPC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZXNlbiBEaWFsb2c8IS0tLS0-PC90aXRsZT48dGl0bGUgaWQ9ImNmNDYwNjI2LTBhMjgtNDZkNS05YzQ1LTdhOGFjMGQ3Y2JmOSI-PCEtLS0tPlNjaGxpZcOfZW4gU2llIGRpZSBDb29raWUtRWluc3RlbGx1bmdlbjwhLS0tLT48L3RpdGxlPjxoMSBjbGFzcz0iZW50cnktdGl0bGUiPgoKCQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBtZXRlcmVkIj4KCQkJQXMgQ2xpbnRvbiBGb3VuZGF0aW9uIGRvbmF0aW9ucyBwbHVuZ2UsIHF1ZXN0aW9ucyByYWlzZWQJCTwvc3Bhbj4KCgkKCTwvaDE-&i6=MmEwZjo5NDQxOjU6MDplNTo6MQ%3D%3D
x-frame-options: DENY
access-control-allow-origin: https://www.pe.com
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 30fde4a29621df15
request-time: 1
content-length: 0
x-content-type-options: nosniff

GET
H2 200 26e2478146b37c080dcb73790254b9d3.js Show response
www.gstatic.com/mysidia/ Frame 3D0E 12 KB
5 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/26e2478146b37c080dcb73790254b9d3.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e76c37aa7c3d8211fdbf11bdfb4ec6474220634bbf95df93e793d08ea2fc311

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 02 Jan 2022 21:16:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 193416
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5010
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 07:52:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 02 Apr 2022 21:16:55 GMT

GET
H2 200 e0e10523822fb3dacbe65c68b82a1439.js Show response
www.gstatic.com/mysidia/ Frame 3D0E 10 KB
4 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e0e10523822fb3dacbe65c68b82a1439.js?tag=text/vanilla_highlight_sizing_fix

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c93ebc110b1a1000cc387bee74dcd5acb7f1569a4d0aa9403cc178acf4b24ab0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4273
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 07:52:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 15:29:09 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 3D0E 3 KB
579 B 30ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 05 Jan 2022 02:10:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 05 Jan 2022 03:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H2 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 3D0E 2 KB
1 KB 82ms
25ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2cb797c032b97fe5bf080e4d0e2537fd7f9a78e8ccc3fb8c4c5bc8ca7415e04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:46:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 939
x-xss-protection: 0
server: cafe
etag: 11779016803434629492
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 02:46:54 GMT

GET
H2 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 3D0E 24 KB
10 KB 73ms
16ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 01:34:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5155
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
server: cafe
etag: 14328493792227503680
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 01:34:36 GMT

GET
H2 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 3D0E 2 KB
1 KB 82ms
26ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e371c9ea0fd636a3ecd29ae5e8413d144d470f77ca4bdda94b6e61ec3b980eb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:21:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2339
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1345
x-xss-protection: 0
server: cafe
etag: 11377196957905752455
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 02:21:32 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3D0E 119 KB
36 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:31 GMT

GET
H2 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 3D0E 18 KB
7 KB 76ms
19ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51bbe57479b8c393497c12c8a7a3e3db77d4d60751017cbebd63ddc54a328819

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7337
x-xss-protection: 0
server: cafe
etag: 7465115486436736623
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 02:45:00 GMT

GET
H2 200 253a7d78465f16f9f81c5652782f72f1.js Show response
www.gstatic.com/mysidia/ Frame 3D0E 36 KB
14 KB 29ms
8ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/253a7d78465f16f9f81c5652782f72f1.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d3bed09ea42550f14c8721f27a7076c4f2a73692c1b8c3191a98c4d3603aace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 19:06:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14076
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 07:52:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Apr 2022 19:06:45 GMT

GET
H2 200 c82b4907e1d878a7212b792043ce335f Show response
s033.pe.com/templates/ 474 KB
69 KB 8ms
8ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/templates/c82b4907e1d878a7212b792043ce335f

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

e878e3e995e89c125a8187b3af26ec48cc6e89c48709316d5389e4066d7ceb5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 20:54:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 8229938
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 70537
x-xss-protection: 1; mode=block
last-modified: Thu, 30 Sep 2021 20:54:53 GMT
server: -
etag: c82b4907e1d878a7212b792043ce335f
content-type: text/javascript; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: FRA56-C1
x-robots-tag: noindex, nofollow
x-amz-cf-id: h4Ui3wa5ypj2-_eID2oRstjrgGsSwDfEwVtl0CWxUT15WeHB2uXclQ==
expires: Sat, 01 Oct 2022 20:54:53 GMT

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 183 B
1 KB 369ms
369ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A31%2B00%3A00&ts=1641351631946

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

7c748c638a73cf4c2a2e26751abd0c356073f77ad4aafb6def23c4d590b89ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 147
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: V_cH_xxaDyVGDJojyNR_Gt0hV7BY4V9-aQ75IJEDnAdxhU78KBxFdQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 stats Show response
s033.pe.com/rest/recommendations/ 14 B
854 B 382ms
381ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/rest/recommendations/stats?storeId=ba57314d-6533-464a-a25f-4bba598ddcde&action=view&itemId=3346815&url=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&profileId=undefined&isEntrypage=true&hash=a2b4f379da58fd4ca8a4ef6c42a357db&lastmodified=1639333198000&&callback=bc_json580

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

269ffb0e73cb3f4d5cf8845c23792191a461fd7d7a93f211191201104067ca5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 34
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
content-type: text/javascript;charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
x-amz-cf-id: _F6ixpk1B4zT3vB6W7t1pDeLB-f4KOvOj3mDcJ5k3FIs6lFxFw_MTA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 359 B
1 KB 372ms
372ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A32%2B00%3A00&ts=1641351632072

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

61aa27d4d674b749c51e6ff3fbe7ab261e0f387e4b9c16ef23efabfeb09934bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 173
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: y3FhkQ11OV5gvkSLiNSFeAry-zIVDi5rY7Enn-YqHG1PaTqJ7sT-Jw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 180 B
1 KB 372ms
372ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A32%2B00%3A00&ts=1641351632076

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

8e1fec0a84e61e269e979fcd14494dcf692ac68379e6ec94c1c36398dbca8b11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 162
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: 0J_cMBAbwQ-qgwC9snw-p8PkK1gCWpA4caGwCYYXPuqjgvKJBACu-w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 cs Show response
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 66 B
862 B 93ms
93ms Script
text/javascript 54.167.130.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&&callback=bc_json581

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.167.130.168 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-167-130-168.compute-1.amazonaws.com

Software

- /

Resource Hash

5f20e2f4399587ed6c61a043de2fb86314171eba2176d1788536ebe1ad01df5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-robots-tag: noindex, nofollow
p3p: policyref="", CP="DSP"
x-permitted-cross-domain-policies: master-only
cache-control: no-cache, no-store, no-transform, must-revalidate, private
content-type: text/javascript; charset=utf-8
content-length: 86
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 B26509325.315074782;dc_ver=81.236;sz=300x600;u_sd=1;gdpr_consent=CPSUmIfPSUmIfEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... Show response
ad.doubleclick.net/ddm/adj/N1549806.422087GROUPMCOMPETENCEC/ Frame 640B 60 KB
25 KB 94ms
57ms Script
text/javascript 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1549806.422087GROUPMCOMPETENCEC/B26509325.315074782;dc_ver=81.236;sz=300x600;u_sd=1;gdpr_consent=CPSUmIfPSUmIfEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA;gdpr=1;nel=1;kw=5llqzru;dc_adk=1575238835;ord=bopew2;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fimp%3Dcd362a7a-d49a-4c98-b2f3-96468e9b24ee%26ag%3D5llqzru%26sfe%3D140c89cf%26sig%3D-CYReVcXBivVEgHT18Z4y3AVcPbX-kGOXMKUm4Mk3Fg.%26crid%3Dwwgxhbhm%26cf%3D2909522%26fq%3D0%26t%3D1%26td_s%3Dwww.pe.com%26rcats%3Dgce%26mcat%3D%26mste%3D%26mfld%3D2%26mssi%3D%26mfsi%3D%26sv%3Dcasale%26uhow%3D76%26agsa%3D%26wp%3DYdUJzwAAAAAwYFZkcAQaCRyeY209iE-oyGr3Pw%26rgz%3D60313%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D185707%26rlangs%3Dde%26mlang%3D%26did%3D%26rcxt%3DOther%26tmpc%3D5.87%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgdHZXJtYW55EgVIZXNzZRoAIhFGcmFua2Z1cnQgYW0gTWFpbjgBUAGAAQCIAQGQAQA.%26dur%3DCjAKDGNoYXJnZS1hbGwtMSIgCP___________wESE3R0ZF9kYXRhX2V4Y2x1c2lvbnMKSAohY2hhcmdlLWFsbE1vYXRWaWV3YWJpbGl0eVRyYWNraW5nIiMIpf__________ARIObW9hdC1yZXBvcnRpbmcqBgigjQYYDA..%26durs%3DAuzKvO%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%20-%20Windows%26pcm%3D1%26ict%3DUnknown%26said%3D5c8b7412-332a-c26d-3f85-49a9cf9f17b3%26auct%3D1%26grdc%3DCAE.%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F$0;xdt=0;crlt=vFqRJ*9P_I;cmpl=8;gcsr=a;sttr=195;prcl=s

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

c393abbd75cd3ab5b3d3e38af1e75fe647a95b2997ac480e534575daad35d125

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24648
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3D0E 0
20 B 17ms
16ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cm6VCzwnVYf2nB7Wxx_AP2eqnmAz-2ufLZ-Cn_bqWD5OY_JHcGxABIOaX1iVglYqJjrAHoAHw9u6RA8gBAakC9m_qk2bqsj6oAwHIA8sEqgSQAk_QiqO8rcFrmsKEFm9aA-Zdnd-cMnx0c5Ac3CYTgH2nUKLPP-S5W5QRfPJ2nTZvsJevswdFoITMyrtjRcYCVIxZ_-vBZ5-dNSZAgS-7n2itxsnj2VqxaIGugBZJI7J5tttlRka40Ikfu0AmJ-omsfxqN3Y6Op3C7ZdgSgQJcKHGs8ZRgOx0OTvtKoBmwZdP6_70jMHcWfKNdcJJlxVJjHLJt11aP87t005FL5ywrS_g4zS1p06Wv1VxgPZtTo44dz_M36D3T1lfyRgUYd4LWIoNFY_tVz0zIwDkxcgWQrYxum4cKFnQ9H3hHXMD7iDkYSj7Zy-X-VGw1Gx18eI1Z9MUVHYlF_t8cmMLjJxiVBJNwATc7Ni7iwOSBQQIBBgBkgUECAUYBIAH-IiRbqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB0ggHCIBhEAEYAPIIDmJpZGRlci01NTU2NTI5gAoEyAsB2BMMiBQI0BUBgBcBshcICgYIABIAGAA&sigh=d-CGF-lA2ec&uach_m=[UACH]&pr=10:0.287714&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 05 Jan 2022 03:00:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 05 Jan 2022 03:00:32 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E6CF 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 05 Jan 2022 02:04:55 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3337
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3D0E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 96432f7a764d600eb5d35cfefa51fbb8e3aa62bafea3bb3fc08225403837124a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 5 KB
3 KB 373ms
373ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A32%2B00%3A00&ts=1641351632141

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

0dfec2daca0c9630407056545bec7c851250781cfc69637dbdb743a078670afa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 2478
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: H7gBrEPC_dD8foBRYDGKdLsjU-DIea9e7_TPk8JOLKD2SMLCOrywcg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 recommendations Show response
s033.pe.com/rest/ 11 KB
4 KB 428ms
427ms Script
text/javascript 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/rest/recommendations?storeId=ba57314d-6533-464a-a25f-4bba598ddcde&profileId=undefined&frequencyCap=8&itemId=3346815&request=%5B%7B%22id%22%3A1560907820833%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2022-01-03T03%3A00%3A32.165Z%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENT_ENTRYPAGE%22%7D%2C%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A12%7D%5D&&callback=bc_json582

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

69bc82f0e59ed9185231ba115af336af7ccf89791a11330a3384c8e4492e6936

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 3349
x-xss-protection: 1; mode=block
pragma: no-cache
server: -
content-type: text/javascript;charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag: noindex, nofollow
x-amz-cf-id: iijamG7p70D5Czf_eGSyaGKKjPHd0UBv8Mr-e3ALQ2jsPhVsR96Z9w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 3D0E 21 KB
21 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 10:56:24 GMT
x-content-type-options: nosniff
age: 57848
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 04 Jan 2023 10:56:24 GMT

GET
H3 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 3D0E 21 KB
21 KB 10ms
10ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 20:07:29 GMT
x-content-type-options: nosniff
age: 24783
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 04 Jan 2023 20:07:29 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E6CF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
18 B

28ms
27ms

Document
text/html

2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 05 Jan 2022 03:00:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 05 Jan 2022 03:00:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 640B 169 KB
59 KB 57ms
7ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Origin: https://www.pe.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 10:25:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59696
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Jan 2022 10:25:36 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame 640B 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1549806.422087GROUPMCOMPETENCEC/B26509325.315074782;dc_ver=81.236;sz=300x600;u_sd=1;gdpr_consent=CPSUmIfPSUmIfEXABBDEBgCwAAAAAH_AAAwIGggBIAJEQABAIAAEAIAEAAAAQBAAAEAgAAAAAAAAAAAABAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAIAAAAAAgXmAAAAkQAAEAAAAAAAAQAAABAEAAAAAAAAAAAAAAAAAAECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA.YAAAAAAAAAAA;gdpr=1;nel=1;kw=5llqzru;dc_adk=1575238835;ord=bopew2;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fimp%3Dcd362a7a-d49a-4c98-b2f3-96468e9b24ee%26ag%3D5llqzru%26sfe%3D140c89cf%26sig%3D-CYReVcXBivVEgHT18Z4y3AVcPbX-kGOXMKUm4Mk3Fg.%26crid%3Dwwgxhbhm%26cf%3D2909522%26fq%3D0%26t%3D1%26td_s%3Dwww.pe.com%26rcats%3Dgce%26mcat%3D%26mste%3D%26mfld%3D2%26mssi%3D%26mfsi%3D%26sv%3Dcasale%26uhow%3D76%26agsa%3D%26wp%3DYdUJzwAAAAAwYFZkcAQaCRyeY209iE-oyGr3Pw%26rgz%3D60313%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D185707%26rlangs%3Dde%26mlang%3D%26did%3D%26rcxt%3DOther%26tmpc%3D5.87%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgdHZXJtYW55EgVIZXNzZRoAIhFGcmFua2Z1cnQgYW0gTWFpbjgBUAGAAQCIAQGQAQA.%26dur%3DCjAKDGNoYXJnZS1hbGwtMSIgCP___________wESE3R0ZF9kYXRhX2V4Y2x1c2lvbnMKSAohY2hhcmdlLWFsbE1vYXRWaWV3YWJpbGl0eVRyYWNraW5nIiMIpf__________ARIObW9hdC1yZXBvcnRpbmcqBgigjQYYDA..%26durs%3DAuzKvO%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%20-%20Windows%26pcm%3D1%26ict%3DUnknown%26said%3D5c8b7412-332a-c26d-3f85-49a9cf9f17b3%26auct%3D1%26grdc%3DCAE.%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F$0;xdt=0;crlt=vFqRJ*9P_I;cmpl=8;gcsr=a;sttr=195;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:35:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1490
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 02:35:42 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 640B 41 KB
15 KB 29ms
13ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 31 Dec 2021 06:24:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 419763
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Dec 2022 06:24:29 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 35B3 22 KB
8 KB 13ms
12ms Document
text/html 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Tue, 04 Jan 2022 20:29:04 GMT
expires: Wed, 04 Jan 2023 20:29:04 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 23488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 b_8rsBg2pSAE7OSEuXeXkmKAJRzK7XLbOE8Wp2RNR2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame 35B3 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/b_8rsBg2pSAE7OSEuXeXkmKAJRzK7XLbOE8Wp2RNR2Q.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6fff2bb01836a52004ece484b97797926280251ccaed72db384f16a7644d4764

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 03 Jan 2022 17:22:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 121101
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13622
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Jan 2023 17:22:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 640B 119 KB
36 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:32 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 65 KB
6 KB 29ms
15ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1d83fc266714550c54c8b2f455921c23ded54ba23ffdd044444534303005ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:32 GMT
expires: Thu, 05 Jan 2023 03:00:32 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 640B 0
23 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjss2tRT3qFq4uZKLn95pqe4iyu9QuOLIA2TFM-_sdfsmhj6rEhrV4gsudjuTy7-PQP6goXmy7QjIAlHWO2JLgxJkpRaQqr4zVG1iVm-Rn_G9BI-ufJMgZ5nalPMJLNQ&sig=Cg0ArKJSzMiMCns0dIrCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=83&cbvp=1&cstd=78&cisv=r20211207.04585&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame FFDB 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 19:13:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27993
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Jan 2023 19:13:59 GMT

POST
H2 200 577 Show response
s033.pe.com/DG/DEFAULT/rest/rpc/ 5 KB
3 KB 467ms
466ms XHR
application/json 65.9.58.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s033.pe.com/DG/DEFAULT/rest/rpc/577?referer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&bcsessionid=313636f7-11b2-4e02-96db-1d090dc8dfaf&bctempid=&overruleReferrer=&time=2022-01-05T03%3A00%3A32%2B00%3A00&ts=1641351632333

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.58.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-58-49.fra56.r.cloudfront.net

Software

- /

Resource Hash

92bcab164dffebb0925797ce70407a8e16b78cedf78621f226ef8fdc824b663a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 2479
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.pe.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: bKltCE17RiUs4HZv_RqIYZx6z1e8kJ8hWNa6FHHI2wDT4dgXenUsaw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 gwdpage_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 55 B
103 B 7ms
7ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdpagedeck_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 731 B
263 B 8ms
7ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdgooglead_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 24 B
72 B 9ms
7ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdimage_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 281 B
187 B 9ms
7ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdattached_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 26 B
74 B 11ms
8ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdtaparea_style.css
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 157 B
144 B 11ms
8ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 googbase_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 400 B
304 B 12ms
9ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 275
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwd_webcomponents_v1_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 20 KB
6 KB 12ms
9ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwd_webcomponents_v1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c27626364eeaffb44ad2decb980dace7bedb3c8ea1575f81927fc9409cb5b49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6276
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdpage_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 3 KB
1 KB 11ms
9ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3260225ba132e9bf8956514e81f6136265ee05250271a027bb2029cbbf4651d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1308
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdpagedeck_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 8 KB
3 KB 17ms
14ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4eefdd923f73deeaec9e4ecb4cc3fae74379145f0fd3f5892165326bce8ed0ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3191
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 08DF 118 KB
40 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 14:56:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43426
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Jan 2022 14:56:46 GMT

GET
H3 200 gwdgooglead_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 13 KB
4 KB 14ms
11ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b671e2140966063715d21667867d60de45adc723cd1b31e0d2f7466105a90247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4481
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdimage_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 5 KB
2 KB 15ms
13ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2014
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdattached_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 1 KB
619 B 16ms
13ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 590
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdtexthelper_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 7 KB
3 KB 16ms
14ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dea5d8ba9e54379b26e109f61ceba20a0781d4f80eed75fce6ad0993d4784195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2823
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdtaparea_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 3 KB
1 KB 13ms
11ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f2aac94d011ec45570ef1245e5fc8df73ebd09b1c6859c5a8393df5336e01b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1356
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwdgpadataprovider_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 3 KB
1 KB 15ms
13ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwdgpadataprovider_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a170f5913eecb1afeda4cccca5d5b9589c8f068a04ae2c517b602e1484982b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1293
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwddatabinder_min.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 5 KB
2 KB 17ms
15ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwddatabinder_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3460d76a3013a4bb9c689877b41f3eadbf5e780ed9230fb8f8bbd16fcc59842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2351
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 gwd-dynamic-binders.js Show response
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 23 KB
9 KB 15ms
14ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/gwd-dynamic-binders.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df544db2e8b010512a5ec168d3a9b91355c7197d04a1b29325510e29405e6e0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9229
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 National2-Medium.woff
s0.2mdn.net/creatives/assets/4372196/ Frame 08DF 45 KB
45 KB 7ms
7ms Font
font/woff 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4372196/National2-Medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66e6fad9e5ec87bcda3f169e68173f0d99c792ec94f8586d7df8a4edb540d1e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 02:57:44 GMT
x-content-type-options: nosniff
age: 168
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46308
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 12:01:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Jan 2022 03:12:44 GMT

POST
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 640B 0
23 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjss2tRT3qFq4uZKLn95pqe4iyu9QuOLIA2TFM-_sdfsmhj6rEhrV4gsudjuTy7-PQP6goXmy7QjIAlHWO2JLgxJkpRaQqr4zVG1iVm-Rn_G9BI-ufJMgZ5nalPMJLNQ&sig=Cg0ArKJSzMiMCns0dIrCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=300&vt=11&dtpt=217&dett=3&cstd=78&cisv=r20211207.04585&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 99F4 0
0 41ms
41ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvoGppny3MSBgyhbzmL24AupT-oFEverFdRsqiLC6zelfwGzhbQu6Jvj-sibCo1CoC5haa0K5g6I5md_j_1U6Zbt-jz1-Nh4PFh3yg2oTrbpiik3ERwWQnc3QB1pgbH9LVaNuhHHw-pJx8RL-IA7kINL1d8xVXFoJdpKNXnCdYRx6_CgbtbK0COxesSkr_Wi3TrsbzaG3spwaVzF75L4ecUKI4qRer0CS0a5QREgz3A2GlweD0kK-D-MJ_OgJcis64J7PHWO39mCLm1Z3W6TWY7ZxLLdx58CGZq5hRSkvwYdxB3tu-D6m42StXJ79jGrjDQlCZx4Q&sig=Cg0ArKJSzNPB2nIV6yh9EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 08DF 6 KB
4 KB 16ms
16ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59c5af195c2e72b427de085a7120d003eabb6253ebdc5e17aa51111e43e414ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4576
x-xss-protection: 0

GET
H3 200 ww-logo.svg
s0.2mdn.net/sadbundle/15488515598264863345/ Frame 08DF 861 B
512 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15488515598264863345/ww-logo.svg

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02e5d19a183da192e043987b408ccc29f42f512819fff85ba46f8a678dbb1773

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Dec 2021 10:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 489901
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 483
x-xss-protection: 0
last-modified: Tue, 14 Dec 2021 15:13:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Dec 2022 10:55:31 GMT

GET
H3 200 60021267_20211209091429391_WW_Winter_Prospecting_Member1.jpg
s0.2mdn.net/ads/richmedia/studio/60021267/ Frame 08DF 37 KB
37 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60021267/60021267_20211209091429391_WW_Winter_Prospecting_Member1.jpg

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a83205ed8814f5032e98f82fdbaf746235da936ce6d8d2b79c60fd611a6ebea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15488515598264863345/index.html?e=69&leftOffset=0&topOffset=0&c=dc2uf5vQHC&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 09:34:50 GMT
x-content-type-options: nosniff
age: 62742
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38176
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 17:14:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Jan 2022 09:34:50 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 08DF 17 KB
6 KB 19ms
18ms Script
text/javascript 2a00:1450:400e:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:810::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 05 Jan 2022 03:00:32 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 35B3 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdeNO0AnVYcbMCY6A9u8Pgc2pSAAAAAA4AeAEAg&bg=!OjmlOX3NAAZKWFskSlg7ACkAdvg8Wquv7FMe-Xx7cPakgr2RZ_58wvdo2tAbsabnCyrkF6vqCQK7wwIAAADZUgAAAAdoAQcKAJ4XyyTP0PiFpObZOX_CI34wYO9S8KAFHstwNNNw-RShJ7jW8y7ckk9Pxaf4jglBzSWCuhwa7qYch7GKhNnxnHG51MOL4b_-1oqQRGCC5NkPHAks39xnjDWj20bnxtPCcmqXioovq6jEq5qTIvemrJmRgC6_6FE9mhEYCXYenUiU9ehOA0OcoS7N3DAVcmjEQ3ZhFyo4bc1mOtHgVFllPZkC2VJryPsRJItNmiTIEnkI_l-OXeA_V36rvhHVuJhTSfYBApNmpsqe1rpArl5ZGs9JhTG6qeanyQoZweNz9J44k5k7sQoLpqHBCc1o1WbyN7DM9yKshcv4vj-xhdrZdrdVN0Li2WN2wPcrHWm9CjLBWW9irYEkaGUEBPXCCF-bfrsYbObQnxAw3AP_4j1ABXul220tAGmYWi-cZtURCdlJm6IDBVJv7hF2jC7zW6qKKEoNLJ_nkRg1V4oK3tXpu1UpPNQ5Dt-Q7f8KROwuKAtbI5YAsapA5DigxFk-Q0skqJdc8hIN9vVfwIMtQLbpV1A36R-KocAKrnlyO5pUiuWCW_FCeMXfWaRanQ2_xm43lzMgODeqMURrY-PE6wy--vH_18ghSxkYYOw3o1KoiCyJpRNm_zdRhTF2I4ocQmynJiO1qGnuVvs7d2Ro6UONQOvCq3esduHaHekqytjv3w5tczTqK7rov6XZ8SXtOqBKuLdZVccRwL69Y4OLA1EXlOZQfcbO4oEVyVUcwRGhYZIjSWTTexkni-GN9hQS8xYnJsaC8UJoTrap1o0e7h9nc6geQz66NGBzge6su6-MSJS6-2BVTzQN3nwSX83_WBOO3QDjqLxI7znntq25e7TfU1cYtjr0NXUOBmJWtqe8Kq7CwpX5osopQr-ZOUgSrgGVT28WEe9X7i_fvK6PvXKJk_CyBxov6M4_HC0deGXCwaNMwOMxsbNUj2WL241IOZ7ZIkb1vMHy1euKzuNWH30OLsC7SNfCtnRluKuVwHj41EcIgmrr8rQZQKfeP0A5IvvXdq2R52aZmGhJZ7_K4B3BiW4a-Vg-lgK34GwQlWyS3qSYaeGzDApRy8n0jbZbH0tN70ysMX8-5nPyZOPEHm39e1lERV26fr0dH8tLzir8KJFjcpMQmo_jV5FFOEztPcMrtITYm7_ZmCI8PXt6sH1pakRPsWl6kS71CAt5bQ

Requested by

Host: www.pe.com
URL: https://www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response
pagead2.googlesyndication.com/bg/ Frame 7BD9 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 19:13:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27993
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13559
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Jan 2023 19:13:59 GMT

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 1C01
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1019 B

8ms
7ms

Document
text/html

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: d13bd7a1939b9e45e1f75b0b0e30689a445a11b84a6301cec4e457434407ae10

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-type: text/html; charset=utf-8
content-length: 456
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

date: Wed, 05 Jan 2022 03:00:32 GMT
content-length: 0
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK a-05gf Show response
i.liadm.com/s/c/ Frame 7284 1 KB
1 KB 434ms
120ms Document
text/html 54.86.119.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-05gf?s=&cim=&ps=true&ls=true&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&

Requested by

Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.86.119.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-86-119-171.compute-1.amazonaws.com

Software

Resource Hash

8eedfc1e0ed881b31e0ba53a1c5c8aa79e795dd75caa5b9e8f1dd68a9a22f14d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/

Response headers

Cache-Control: private, no-cache, max-age=0
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 05 Jan 2022 03:00:32 GMT
ETag: 1.61803398874
Strict-Transport-Security: max-age=31536000; includeSubDomains
trace-id: 08c6c091ed2d4cdc
Vary: Accept-Encoding
Content-Length: 667
Connection: keep-alive

GET
H/1.1 200
OK baker
sli.pe.com/ 19 B
359 B 81ms
12ms Image
image/gif 2.16.186.235
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.pe.com/baker?dtstmp=1641351632645
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.235 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-235.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Expires: Wed, 05 Jan 2022 03:00:32 GMT
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
BLOB 200
OK d80d4666-1e0c-4fec-825a-ab9ea79afb8b
https://www.pe.com/ 390 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.pe.com/d80d4666-1e0c-4fec-825a-ab9ea79afb8b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Length: 390
Content-Type: text/javascript

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 149ms
15ms Preflight 13.69.106.89
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.89 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,sdk-context
Origin: https://www.pe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-methods: POST
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin: *
access-control-max-age: 3600
x-content-type-options: nosniff
date: Wed, 05 Jan 2022 03:00:32 GMT
content-length: 0

POST
H2 206 track Show response
dc.services.visualstudio.com/v2/ 223 B
407 B 72ms
72ms XHR
application/json 13.69.106.89
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.89 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: 3D5A29D2-EAFD-4598-8006-5257560CA20D
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Wed, 05 Jan 2022 03:00:32 GMT
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length: 223

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 1C01 70 B
264 B 32ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

404

xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf
eb2.3lift.com/ Frame 1C01
Redirect Chain

https://ad.mrtnsvr.com/sync/triplelift
https://eb2.3lift.com/xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf

37 B
155 B

7ms
7ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: no-cache, no-store, must-revalidate
x-error: Not Found
content-length: 37
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf
date: Wed, 05 Jan 2022 03:00:32 GMT
via: 1.1 google
alt-svc: clear
content-length: 92
vary: Origin
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 1C01
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENhsTq7G1DoUrG4HsyielHg&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1

37 B
351 B

9ms
9ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENhsTq7G1DoUrG4HsyielHg&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENhsTq7G1DoUrG4HsyielHg&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1C01
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg0NzQyNjgxODM3NTc1Mjg1

170 B
317 B

20ms
16ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg0NzQyNjgxODM3NTc1Mjg1

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=Mzg0NzQyNjgxODM3NTc1Mjg1
date: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 1C01 0
705 B 223ms
200ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=384742681837575285&dbredirect=true&gdpr=1&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4F0EF8633FF740678297A657BE1C6D0B Ref B: FRAEDGE1406 Ref C: 2022-01-05T03:00:32Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXUzPUGdhFoQtWktgvXEw==

GET
H2

200

xuid
eb2.3lift.com/ Frame 1C01
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/384742681837575285?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-BhxHYk5E2oSMRtK0kxP59KBLgHJOWt5gr0_isrSbOQ--~A&dongle=0883

37 B
351 B

10ms
10ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-BhxHYk5E2oSMRtK0kxP59KBLgHJOWt5gr0_isrSbOQ--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:32 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Wed, 05 Jan 2022 03:00:32 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-BhxHYk5E2oSMRtK0kxP59KBLgHJOWt5gr0_isrSbOQ--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 1C01 43 B
220 B 9ms
8ms Image
image/gif 3.124.83.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=triplelift&user_id=384742681837575285&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.83.68 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-83-68.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:32 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 c.gif
c.bing.com/ Frame 1C01 42 B
593 B 61ms
31ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=384742681837575285&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
etag: "f95a3e4769d2d71:0"
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 82F7BF1DCB694A3CAE3BFD4FB1F4D92F Ref B: FRAEDGE1406 Ref C: 2022-01-05T03:00:32Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 1C01
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=384742681837575285
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=384742681837575285&dcc=t

0
0

95ms
95ms

Image
text/html

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=384742681837575285&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Server: 209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:32 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 8CBV2KT9NX818X1WWNZX
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=384742681837575285&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 1C01
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

7ms
7ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 4CC9 0
820 B 13ms
13ms Ping
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.pe.com%2F2021%2F12%2F12%2Fas-clinton-foundation-donations-plunge-questions-raised%2F&e=wqT_3QK8Bug8AwAAAwDWAAUBCM-T1I4GEI7FiuCkx_qQFxgAKjYJbHwm--dp0j8RiESIyDw00D8ZAAAAgOtRJ0AhiA0SACkRJMgxAAAAQOF6_D8wmYSXCjj8SEDlHkhlUK2iyyVY_KldYABojIJ3eIjuA4ABAYoBA1VTRJIFBvCamAHKB6AB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgApWgSOoCVmh0dHBzOi8vd3d3LnBlLmNvbS8yMDIxLzEyLzEyL2FzLWNsaW50b24tZm91bmRhdGlvbi1kb25hdGlvbnMtcGx1bmdlLXF1ZXN0aW9ucy1yYWlzZWQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWgNbExwYWdlYWQyLmdvb2dsZXN5bmRpYwVaAC4BfwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQUVlV3J4ZDhtTlo3S2wyc3lOWnlNbXpBbC1MQW5CYWQ2QTVaNklEY1JFbF9kNk9mTDdmQXpybTVRN0lsaEtUa3JIU1RmdVRvQnJOdGRVZ1o0emV5Y1Q4N2R2WVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTY2Njg3MDg3MzIwODAzODAzMCIINzg4Mjc4MjEqBDM5NDE6ATDAA6wCyAMA2AOxBuADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA05MS4xOTkuMTE4LjczqAQAsgQQCAAQARjKByD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8AStossliAUBmAUAoAWp8Omj8ciJ2yHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAEzLPA_0AbujwHaBhYKEAEQLgEAoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHEQgAASlMKgQxLS0tOMAGQAHIB4juA9IHDQkRTQEgCNoHBgkpROAHAOoHAggA8AeZiwOKCAIQAA..&s=32e83dc1a8eae33494ecb1af0b2e9e82c5723422&type=pv&jm=1003&px=315&py=178&bw=970&bh=250&sf=1&sid=6643957101815058155&vd=ct~0|rr~5&sv=222&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=21348889&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:32 GMT
X-Proxy-Origin: 91.199.118.73; 91.199.118.73; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 03875901-6af5-4380-8646-5fbf0f6903e9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.pe.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 570 B
912 B 301ms
232ms Fetch
application/json 104.26.5.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1641351632809
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.5.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e80c9b8012ae8a982791e1d587b648ad62640e358e405b25a47ae45ac61b8bd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 05 Jan 2022 03:00:33 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fB3cBUzDfDVvh%2FtM07NJYqR3tj8rTzyzYqAW6%2BWkMTDpKkF%2BNwjOOdwSPyG81JDK4bINdR%2FZaXXz75UqJX7dVKXb7XgD4oyXNDeXUWJ6mm3vprCHDGNqo7jI%2BLRXOnrr9zmP"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c8974f98f0b010d-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4CC9 42 B
64 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvEI-g5HhiUC0X_uwzokTMMQ26-f7h5yVYRz9X3k7YhOcoAi3tdTSMyGxu07FifyfPgrA6UzQGjZ5cd5Q8juhvfEdD_SZpPmP_R9vro8JLJcuBhCo-I&sig=Cg0ArKJSzPxw8L5moKfmEAE&id=lidar2&mcvt=1000&p=178,315,428,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1406879670&rs=4&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641351631636&rpt=123&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

8e64e57691a841fb823da5568e7e1ecf
i.liadm.com/s/e/a-05gf/0/ Frame 7284
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid%3D7156%26muid%3D%5BMM_UUID%5D&f6ee0dcf-545d-4108-9458-a525fe49d39e&us_priva...
https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=7156&muid=b1ef61d5-09d0-4b00-aa66-76efd2e05097

43 B
285 B

160ms
101ms

Image
image/gif

54.86.119.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=7156&muid=b1ef61d5-09d0-4b00-aa66-76efd2e05097

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-05gf?s=&cim=&ps=true&ls=true&duid=76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&

Protocol

HTTP/1.1

Server

54.86.119.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-86-119-171.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:32 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: a07f23300ec3d5e2
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Date: Wed, 05 Jan 2022 03:00:33 GMT
Server: MT3 4133 baa842e master zrh-pixel-x25 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=7156&muid=b1ef61d5-09d0-4b00-aa66-76efd2e05097
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 05 Jan 2022 03:00:32 GMT

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 7284
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&us_privacy=1---
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898

43 B
447 B

275ms
92ms

Image
image/gif

2600:1f18:444a:4602:b51a:2bef:14:5241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:444a:4602:b51a:2bef:14:5241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 4740eb94f02eeb6c
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898
Date: Wed, 05 Jan 2022 03:00:33 GMT
Connection: keep-alive
trace-id: 5be075d38f6eb89c
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

8e64e57691a841fb823da5568e7e1ecf
i.liadm.com/s/e/a-05gf/0/ Frame 7284
Redirect Chain

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=https:%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-05gf%2F0%2F8e64e57691a841fb823da5568e7e1ecf%3Fmpid=82775&muid=$%7BDD_UUI...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=https:%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-05gf%2F0%2F8e64e57691a841fb823da5568e7e1ecf%3Fmpid...
https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=82775

43 B
285 B

185ms
103ms

Image
image/gif

54.86.119.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=82775

Requested by

Protocol

HTTP/1.1

Server

54.86.119.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-86-119-171.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:32 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 6cb85079f2b6212e
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

DCS: dcs-prod-irl1-1-v026-0af43dd6b.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: HZPRehqzSuU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://i.liadm.com/s/e/a-05gf/0/8e64e57691a841fb823da5568e7e1ecf?mpid=82775
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

live_intent_sync
x.dlx.addthis.com/e/ Frame 7284
Redirect Chain

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---&rd=Y

43 B
601 B

153ms
152ms

Image
image/gif

104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---&rd=Y

Requested by

Protocol

Server

104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-215-191.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 05 Jan 2022 03:00:33 GMT
content-length: 43
strict-transport-security: max-age=2628000
content-type: image/gif

Redirect headers

location: https://x.dlx.addthis.com/e/live_intent_sync?na_exid=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---&rd=Y
pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 05 Jan 2022 03:00:33 GMT

GET
H/1.1

200
OK

52176
i6.liadm.com/s/ Frame 7284
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=f6ee0dcf-545d-4108-9458-a525fe49d39e&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
https://i6.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

43 B
447 B

289ms
92ms

Image
image/gif

2600:1f18:444a:4602:b51a:2bef:14:5241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:444a:4602:b51a:2bef:14:5241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 2b17c1889cd2c59d
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/52176?bidder_id=5298&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
Date: Wed, 05 Jan 2022 03:00:33 GMT
Connection: keep-alive
trace-id: 8164ece15f569f2c
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

52164
i.liadm.com/s/ Frame 7284
Redirect Chain

https://x.bidswitch.net/sync?ssp=liveintent&user_id=f6ee0dcf-545d-4108-9458-a525fe49d39e&us_privacy=1---
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=a0dc42e1-1dac-431b-b107-0acda5007d5d&user_group=1&ssp=liveintent&bsw_param=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

43 B
447 B

165ms
91ms

Image
image/gif

54.86.119.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037

Requested by

Protocol

HTTP/1.1

Server

54.86.119.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-86-119-171.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 05f1ffe6e2c81365
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: //i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=8a5c3ef5-a438-4523-9f5f-6b05dea6c037
Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

64716
i.liadm.com/s/ Frame 7284
Redirect Chain

https://trc.taboola.com/sg/liveintent/1/cm/?us_privacy=1---
https://i.liadm.com/s/32441?bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f
https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f&previous_uuid=faea0ea8cb4043a9b3e294032e44c7b4

43 B
447 B

102ms
102ms

Image
image/gif

54.86.119.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f&previous_uuid=faea0ea8cb4043a9b3e294032e44c7b4

Requested by

Protocol

HTTP/1.1

Server

54.86.119.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-86-119-171.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 03:00:33 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 700640570b60ccd7
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=88068&bidder_uuid=395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f&previous_uuid=faea0ea8cb4043a9b3e294032e44c7b4
Date: Wed, 05 Jan 2022 03:00:32 GMT
Connection: keep-alive
trace-id: 9ef2d98301db9999
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 204
No Content /
02179910.akstat.io/ 0
351 B 39ms
16ms Ping
image/gif 2a02:26f0:1700:38a::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://02179910.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/SGCYZ-MP4L3-UVUWR-U6DK7-CV3SL

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:1700:38a::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:33 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.pe.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Wed, 05 Jan 2022 03:00:33 GMT

GET
H2 200 vendors~Auth0UniversalLoginAuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 143 KB
42 KB 10ms
10ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/vendors~Auth0UniversalLoginAuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FC7) /
Resource Hash: 6f87d87de84dc36cab28965d9e1d940c250f399860acafe55f3dac01d54399ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: o/3Cfwyx2Hdo/xXi+KtqIw==
age: 22197
x-cache: HIT
content-length: 43195
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:48 GMT
server: ECAcc (frc/8FC7)
etag: 0x8D9056E3D50F079
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5da3e591-101e-0079-52ac-014f35000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 Auth0UniversalLoginAuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 11 KB
3 KB 14ms
14ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/Auth0UniversalLoginAuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F80) /
Resource Hash: dde5f5e3043fff6c7a7f24a307eac6ac7317e7d6db0085fbbe268eb11ba08699

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: E5fyjsIr92YKgvTS5SE4ZA==
age: 22196
x-cache: HIT
content-length: 3400
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8F80)
etag: 0x8D9056E339D05A5
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: bac33af0-501e-00fd-0bac-01191d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 Auth0AuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 7 KB
2 KB 13ms
12ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/Auth0AuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E9E) /
Resource Hash: 99bea1588717259aa23413b0659c1eb6a0fe227b10eb213e8d9068fd1aa23b96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: jBig/iW/Mpw+sfYWVt9mLw==
age: 22196
x-cache: HIT
content-length: 2320
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:31 GMT
server: ECAcc (frc/8E9E)
etag: 0x8D9056E3391B836
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: bfc09ae6-001e-0044-0bac-01fa13000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 CustomAuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 6 KB
2 KB 14ms
13ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/CustomAuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F12) /
Resource Hash: 80e63f47bb601d1782367bf3015482e86cad9fa03cbfce5ec26502c016d4d47b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: WtHQ46VooZh5jhibUEIm/g==
age: 22196
x-cache: HIT
content-length: 2146
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8F12)
etag: 0x8D9056E33BE9F96
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d5f96ef6-001e-0022-34ac-014849000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 JanrainAuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 9 KB
3 KB 14ms
13ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/JanrainAuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F95) /
Resource Hash: 1d4e66ef8f5ea94ffe457c995d263d41163c06c199cb6900dfc368b2214794a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: 3loC7XOiphfHLLmAxSEZ5g==
age: 22197
x-cache: HIT
content-length: 2639
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8F95)
etag: 0x8D9056E33C99EC8
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: fbf9da67-a01e-0085-7cac-0171aa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 MG2AuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 9 KB
3 KB 14ms
14ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/MG2AuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FAB) /
Resource Hash: 8cf0bb9486df56f8bfc90a4ba4d7317243f9ca37aa6ec6193214e9a0d640744c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: 53DSePPJylXjWw4MlYhYcA==
age: 22184
x-cache: HIT
content-length: 2456
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8FAB)
etag: 0x8D9056E33DFC44A
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 22c12e2a-b01e-00b8-2eac-01c48c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 NewzwareAuthSystem.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 13 KB
4 KB 15ms
14ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/NewzwareAuthSystem.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F8E) /
Resource Hash: 2fcc3c30a10f35c852ff3d27a846dcde5c87dfe2b6c2abd7c2a58f67791f9df2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-encoding: gzip
content-md5: XXTxgTgPuF9lg38Cul1d8Q==
age: 22239
x-cache: HIT
content-length: 4009
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8F8E)
etag: 0x8D9056E33EAC378
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 16114ded-501e-007e-76ac-01b9b0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 LikeButtons4.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 114 B
264 B 12ms
11ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/LikeButtons4.js
Requested by: Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F1E) /
Resource Hash: 64ff9f874a5fd24a871b1d9cd7ee49e4d92bc27ce63c05e94bedc4f7adcc0a11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 05 Jan 2022 03:00:33 GMT
content-md5: 0is0k5hNwCAMRJ10IGm41w==
age: 22197
x-cache: HIT
content-length: 114
x-ms-lease-status: unlocked
last-modified: Thu, 22 Apr 2021 09:08:32 GMT
server: ECAcc (frc/8F1E)
etag: 0x8D9056E33D49E04
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: cf0cea17-201e-00f9-6bac-01ec9f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19
accept-ranges: bytes

OPTIONS
H/1.1 200
OK views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 0
0 130ms
129ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=fc429d9de8d0d4ec0e5fcb8967abe7a3&ConfigCode=SCNGPRODWP&SiteCode=DFM&SettingsKey=LANG%2CPE
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Origin: https://www.pe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
X-Powered-By: ASP.NET
Date: Wed, 05 Jan 2022 03:00:33 GMT
Content-Length: 0

GET
H/1.1 200
OK views Show response
prod-dfm-proxy-connext.azurewebsites.net/api/ 65 B
1 KB 214ms
214ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=fc429d9de8d0d4ec0e5fcb8967abe7a3&ConfigCode=SCNGPRODWP&SiteCode=DFM&SettingsKey=LANG%2CPE
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: b95b7840dd4e76f60f9b3d9c3a7dcff21135b740611568ab4044853964694fec

Request headers

source-system: Plugin
site-code: DFM
autoqa: false
Accept-Language: de-DE,de;q=0.9
settingskey: LANG,PE
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE2NDEzNjYwMzF9.TivBsGja4ucuZZ1V3DzKXuGEtcahwrg4QFbw76jLroM
environment: prod
config-code: SCNGPRODWP
access-control-allow-origin: *
ssid: 28cc29c47d69f6bd1b4eb5fc44b62444
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
accept: application/json
content-type: application/json
location: System
attr: PE
Referer: https://www.pe.com/
version: Version: 2.5.4.3_swg

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 03:00:33 GMT
Content-Encoding: gzip
Expires: -1
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time,Request-Context
Cache-Control: no-cache
Content-Length: 177
X-Server-Time: 1/5/2022 3:00:33 AM
Request-Context: appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 99F4 6 KB
3 KB 36ms
9ms Script
text/javascript 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=r9vak6v_5llqzru_wwgxhbhm&w=300&h=600&c=tradedesk01cont1&js=pmw1&base=te-clr1-ac078494-8a16-4911-bed2-b6a5517ccec7&sid=0
Requested by: Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/e95be28ae04bb3f5bf2c680cd31bfa74fa7ff6ac3aee80299166d3529f902985
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 313e06542afcdab8e56d24b6677dc400b2d9d8a3e6650f1e05260e0148a84170

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 02:16:39 GMT
content-encoding: gzip
server: nginx
age: 2634
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA6-C1
content-length: 2381
x-amz-cf-id: -HXp11YuDQ3ibKhGdfcsUISHpIDaQmxmWf_rgDCjoNChZv2mm5uE6g==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 99F4 38 KB
11 KB 34ms
8ms Script
text/javascript 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=r9vak6v_5llqzru_wwgxhbhm&w=300&h=600&c=tradedesk01cont1&js=pmw2
Requested by: Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/e95be28ae04bb3f5bf2c680cd31bfa74fa7ff6ac3aee80299166d3529f902985
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 04 Jan 2022 20:00:40 GMT
content-encoding: gzip
server: nginx
age: 25193
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 8y1fsOE9udY0mn9w37Gzf5iCIgltcbvxtkXX8x87tmZmxd4JqJKrVA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 99F4 43 B
394 B 132ms
106ms Image
image/gif 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=r9vak6v_5llqzru_wwgxhbhm&w=300&h=600&c=3cc8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA6-C1
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: 3yhqVuM5tBX_JYf6I6l5Nv0ve709RQyAlneiSMnYLZYyURLfObihng==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3D0E 42 B
64 B 43ms
42ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu87XQca0x345L5ncS40prmEIDHgpKN3N0s4AxOFKycjPH_Z_XRVRkY4BcBQ_Lys_g1hj57GMvkvWgoBodvU3Vod1mW2uwNlV2AQfuYC_Z1pcKPUZI&sig=Cg0ArKJSzJ1T1G1_LPhbEAE&id=lidar2&mcvt=1001&p=0,0,250,970&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2257551127&exk=1699395584&rs=5&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641351631640&rpt=671&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 99F4 287 B
627 B 7ms
6ms Image
image/png 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Dec 2021 06:27:51 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
server: nginx
age: 1456362
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA6-C1
timing-allow-origin: *
content-length: 287
x-amz-cf-id: OBrAnKTcYLVK0nPVlRSmmDbGUKGt4b-1Es_GF2nHMNqeyqcJEm7x-Q==
expires: Tue, 18 Jan 2022 06:27:51 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 640B 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstoefBkKDvAt1bRXaN3cCRVhHCwZDkrUaj7084jidv_ofnCQd9R2gdJCojSys7f0YsyJfRQ7b2AgtVKkc-EyZM&sig=Cg0ArKJSzIuBrcet_N6GEAE&id=lidar2&mcvt=1001&p=0,0,600,300&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=0.91&app=0&itpl=34&adk=1575238835&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641351631908&rpt=491&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 3D54 287 B
627 B 7ms
6ms Image
image/png 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by: Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/e95be28ae04bb3f5bf2c680cd31bfa74fa7ff6ac3aee80299166d3529f902985
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Sun, 19 Dec 2021 06:27:51 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
server: nginx
age: 1456362
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA6-C1
timing-allow-origin: *
content-length: 287
x-amz-cf-id: 3SsfNUhe-1OXU-03zH4VXfWUr8PKnKWj1usziA8K49tm6cnlyR8KYw==
expires: Tue, 18 Jan 2022 06:27:51 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 3D54 739 B
1 KB 7ms
6ms Image
image/png 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: public
date: Mon, 13 Dec 2021 13:36:21 GMT
via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
server: nginx
age: 1949052
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA6-C1
timing-allow-origin: *
content-length: 739
x-amz-cf-id: vFiwCoWEO14g5_DLODR27kG4a8eErwwkiEXoAXgonklRKox9kU-Ddw==
expires: Wed, 12 Jan 2022 13:36:21 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 99F4 42 B
64 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssNKh75wLOBTfs_9l5ELnBPRNVeLZhRvnhASbPOCjDOuH82rH9jdt-ur3ChLWbFAs_RlSvG_WaK4Rasi3dj49xGsJ_EaWb7nSXbgvXkveht2wPe0EmC&sig=Cg0ArKJSzO-QDXuJSEl2EAE&id=lidar2&mcvt=1001&p=657,1138,1257,1438&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=0.91&app=0&itpl=19&adk=2963075417&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641351631643&rpt=868&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.pe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 03:00:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 event-stream Show response
k.p-n.io/ 0
126 B 33ms
7ms Fetch 18.157.162.207

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=fkjYqXOFi7cOqgLTgon5YXK4T2wSq6RySYFr&ver=5.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.162.207 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 05 Jan 2022 03:00:37 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

POST
H2 204 event-stream Show response
k.p-n.io/ 0
125 B 7ms
7ms Fetch 18.157.162.207

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=fkjYqXOFi7cOqgLTgon5YXK4T2wSq6RySYFr&ver=5.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.162.207 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.pe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 05 Jan 2022 03:00:37 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: geo.privacymanager.io
URL: https://geo.privacymanager.io/

Verdicts & Comments Add Verdict or Comment

154 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

57 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.pe.com/2021/12/12/as-clinton-foundation-donations-plunge-questions-raised	1970-01-19 23:55:51	Name: _liChk Value: 0.6844753601249494
s033.pe.com/DG/DEFAULT	1970-01-20 09:31:51	Name: BCSessionID Value: 313636f7-11b2-4e02-96db-1d090dc8dfaf
digitalfirstmedia.blueconic.net/DG/DEFAULT	1970-01-20 08:41:27	Name: BCSessionID Value: 313636f7-11b2-4e02-96db-1d090dc8dfaf
.3lift.com/sync	1970-01-20 02:05:27	Name: sync Value: CgoIgQIQha65weIvCgoI4gEQha65weIvCgoI5gEQha65weIvCgoIhwIQha65weIvCgkICRCFrrnB4i8KCQg6EIWuucHiLwoJCAsQha65weIvCgoIjAIQha65weIvCgoIngIQha65weIvCgkIXxCFrrnB4i8=
.mrtnsvr.com/sync	1970-01-20 08:42:54	Name: userId Value: LwyYwKs4p
i.liadm.com/s	1970-01-20 00:39:03	Name: _li_ss Value: MgUIBhCjETIFCAoQoxEyBQh-EKIRMgYIiwEQoxEyBQgLEKMRMgUIDBCjETIFCHkQohEyCQj_____BxCjEQ
www.pe.com/	1970-01-20 08:41:27	Name: ai_user Value: QTHQj\|2022-01-05T03:00:30.288Z
.pe.com/	1970-01-20 08:41:27	Name: bc_tstgrp Value: 5
.pe.com/	1970-01-29 23:54:25	Name: _pnvl Value: false
.pe.com/	1970-01-29 23:54:25	Name: pushly.user_puuid Value: aI0jNLjclYoOQqNUhTs8cimOIn44JGR4
.pe.com/	1970-01-29 23:54:25	Name: _pndnt Value:
.pe.com/	1970-01-29 23:54:25	Name: _pnss Value: none
.criteo.com/	1970-01-20 09:17:27	Name: uid Value: 3bbbad98-45c9-4e50-8af1-cd14272ab047
.adsrvr.org/	1970-01-20 08:41:27	Name: TDID Value: 8b02bfed-0a8b-4e0b-b2be-8e2dcfde6898
.scorecardresearch.com/	1970-01-20 17:12:39	Name: UID Value: 1ADO7E7AN8JQ2A3KXOWQE0g1641351631
.liadm.com/	1970-01-20 17:27:03	Name: lidid Value: f6ee0dcf-545d-4108-9458-a525fe49d39e
.rubiconproject.com/	1970-01-20 08:41:27	Name: khaos Value: KY0YDS1L-L-6THC
.rubiconproject.com/	1969-12-31 23:59:59	Name: rsid Value: 1\|A9CsNFoQ5K/DWCet2ogsIBP0vIhaOOWfliBRT/qkfmAh+urPaQTjRsKcZLjliObLRXOqtD6qDAuneV3IXSeRTVvE8QI6g1Y1yk4Vad3QREh28zX8YKRfI6r+JKnHMVn/BdTLwVQPPUDx
.rubiconproject.com/	1970-01-20 08:41:27	Name: audit Value: 1\|naVuGyos1qrMm93zkACHbqQ/Fn9jJ2Tlph+Ceuqbr/er5SX0FILXDLbqNQ/Yr8Z8DsyhWpt+CS3ggJ3pD4CYm1RlNqaEnf5I0A+VO7RH1E0=
.adnxs.com/	1970-01-20 02:05:27	Name: icu Value: ChgIloRKEAoYASABKAEwz5PUjgY4AUABSAEQz5PUjgYYAA..
.adnxs.com/	1970-01-20 02:05:27	Name: uuid2 Value: 4042104120816151112
.pe.com/	1970-02-25 11:55:51	Name: anonDeviceId Value: fc429d9de8d0d4ec0e5fcb8967abe7a3
.bidswitch.net/	1970-01-20 08:41:27	Name: tuuid Value: 8a5c3ef5-a438-4523-9f5f-6b05dea6c037
.bidswitch.net/	1970-01-20 08:41:27	Name: c Value: 1641351631
.bidswitch.net/	1970-01-20 08:41:27	Name: tuuid_lu Value: 1641351631
.taboola.com/	1970-01-20 08:41:27	Name: t_gid Value: 395c1108-7d08-41ba-adbb-093c8ed5af23-tuct8ce8f4f
.adform.net/	1970-01-20 00:40:30	Name: C Value: 1
.adform.net/	1970-01-20 01:22:15	Name: uid Value: 4721132336764932446
.pe.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .pe.com
.pe.com/	1970-01-20 17:27:03	Name: _lc2_fpi Value: 76e39bb7f45e--01frm2wmsrg1kbqs1cm73k4gkd
digitalfirstmedia.blueconic.net/	1970-01-20 00:05:56	Name: AWSALBCORS Value: gWvb+bOgVvhN+07jEqyjhS1Zxl1bBcM7Ux95f7VMBwO4ob619WUDLddWp9JuSEQe4lQV7+EGdsjRpNnvbIXRi6dJRejfvFNgSqDFHC3Qhbj8Xqj6XWAdV1Z5/0nz
.getrockerbox.com/	1970-01-20 00:39:03	Name: uuid Value: 4042104120816151112
.doubleclick.net/	1970-01-19 23:55:55	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 09:17:27	Name: IDE Value: AHWqTUmTnCoKTMD4VQGBxYWDLQhvAwR4B7NRQFZlBUrneWIxCCHUHgPsXSn2Oobk
.pe.com/	1970-01-20 00:05:56	Name: RT Value: "z=1&dm=pe.com&si=00b10a31-41c3-4629-89d3-19443f877c36&ss=ky0ydqlj&sl=1&tt=2kc&bcn=%2F%2F02179910.akstat.io%2F&ld=2ke"
.3lift.com/	1970-01-20 02:05:27	Name: tluid Value: 384742681837575285
.bing.com/	1970-01-20 09:17:27	Name: MUID Value: 0B75072872F26412115A160B73996561
www.pe.com/	1970-01-20 00:39:03	Name: ABTestCookie Value: B
s033.pe.com/	1970-01-20 00:05:56	Name: AWSALB Value: Zl0+YY4rkf1qajTb3oda+iSkVdYRv6gjICHaO4eSzPFTBCoaQ1aZI//zxKl12s+Mb/SzB8rEe9iNT1Jm46LQfFHRpnaa0JFRb09YE5SQ75jJx1LcbGfJ7vbwro5B
s033.pe.com/	1970-01-20 00:05:56	Name: AWSALBCORS Value: Zl0+YY4rkf1qajTb3oda+iSkVdYRv6gjICHaO4eSzPFTBCoaQ1aZI//zxKl12s+Mb/SzB8rEe9iNT1Jm46LQfFHRpnaa0JFRb09YE5SQ75jJx1LcbGfJ7vbwro5B
.yahoo.com/	1970-01-20 08:41:49	Name: A3 Value: d=AQABBNAJ1WECECg5R9LkO6jDie9yUn1N9QcFEgEBAQFb1mHeYQAAAAAA_SMAAA&S=AQAAAh0pI3tx6TT6KIZOXXrFihk
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:27:45	Name: bcookie Value: "v=2&9d928b00-78ca-48a5-8e9e-7f6f5b2b6d94"
.linkedin.com/	1970-01-20 17:01:21	Name: li_gc Value: MTswOzE2NDEzNTE2MzI7MjswMjGm6vua8cQKJr9gR6xB0RkiiuQstmUyu7PMS8R4kjjsKw==
.linkedin.com/	1970-01-19 23:57:18	Name: lidc Value: "b=VGST00:s=V:r=V:a=V:p=V:g=2598:u=1:x=1:i=1641351632:t=1641438032:v=2:sig=AQE9fa-cQnvVD4GH9X1rBbaaO0uGD4Ez"
.adsrvr.org/	1970-01-20 08:41:27	Name: TDCPM Value: CAESGAoJbW9va2llLXBzEgsI7NiJmbKAqDoQBRIZCgpsaXZlaW50ZW50EgsI9PzdprKAqDoQBRgBIAEoAjILCPT04NPIgKg6EAU4AVoKbGl2ZWludGVudGAC
.mathtag.com/	1970-01-20 09:21:46	Name: uuid Value: b1ef61d5-09d0-4b00-aa66-76efd2e05097
.demdex.net/	1970-01-20 04:15:03	Name: demdex Value: 21558240901202753100777069759021383853
pool.admedo.com/	1970-01-20 08:41:27	Name: tuuid Value: a0dc42e1-1dac-431b-b107-0acda5007d5d
pool.admedo.com/	1970-01-20 08:41:27	Name: c Value: 1641351633
pool.admedo.com/	1970-01-20 08:41:27	Name: tuuid_lu Value: 1641351633
.dpm.demdex.net/	1970-01-20 04:15:03	Name: dpm Value: 21558240901202753100777069759021383853
.addthis.com/	1970-01-20 09:26:06	Name: na_id Value: 2022010503003300015829812090
.addthis.com/	1970-01-20 09:26:06	Name: na_tc Value: Y
.addthis.com/	1970-01-20 09:26:06	Name: uid Value: 61d509d194812e3b
.addthis.com/	1970-01-20 09:26:06	Name: ouid Value: 61d509d100018e55e04f0680e0e02c3e3dae002b1acb86e0e192
.dlx.addthis.com/	1970-01-20 00:39:03	Name: na_sc_x Value: 1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope Message: Failed to load resource: the server responded with a status of 451 ()
deprecation	warning	Message: 'window.webkitStorageInfo' is deprecated. Please use 'navigator.webkitTemporaryStorage' or 'navigator.webkitPersistentStorage' instead.
network	error	URL: https://eb2.3lift.com/xuidmid=7976&xuid=LwyYwKs4p&dongle=u6nf Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

02179910.akstat.io
12bd55325b2b328bd8c46e84ec781027.safeframe.googlesyndication.com
a2130.casalemedia.com
ad.doubleclick.net
ad.mrtnsvr.com
ads.pubmatic.com
ajax.googleapis.com
ams1-ib.adnxs.com
api-mg2.db-ip.com
api.rlcdn.com
as-sec.casalemedia.com
ats.rlcdn.com
az416426.vo.msecnd.net
b-code.liadm.com
b1sync.zemanta.com
bidder.criteo.com
c.amazon-adsystem.com
c.bing.com
c.go-mpulse.net
c1.adform.net
cdn.adnxs.com
cdn.auth0.com
cdn.ayc0zsm69431gfebd.xyz
cdn.jsdelivr.net
cdn.p-n.io
cdn.parsely.com
choices.trustarc.com
choices.truste.com
cm.g.doubleclick.net
cmp.osano.com
dc.services.visualstudio.com
digitalfirstmedia.blueconic.net
dpm.demdex.net
eb2.3lift.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
googleads.g.doubleclick.net
gum.criteo.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
i6.liadm.com
ib.3lift.com
ib.adnxs.com
idx.liadm.com
ie1-bid.adsrvr.org
image6.pubmatic.com
insights.zeustechnology.com
js-sec.indexww.com
k.p-n.io
loader-cdn.azureedge.net
match.adsrvr.org
match.prod.bidr.io
metrics.getrockerbox.com
mid.rkdms.com
mng-pe.zeustechnology.com
mug.criteo.com
odr.mookie1.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pixel.wp.com
polyfill.io
pool.admedo.com
pr-bh.ybp.yahoo.com
prod-dfm-proxy-connext.azurewebsites.net
px.ads.linkedin.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s0.2mdn.net
s033.pe.com
sb.scorecardresearch.com
scripts.webcontentassessor.com
secure.adnxs.com
securepubads.g.doubleclick.net
sli.pe.com
ssp-sync.criteo.com
static.criteo.net
stats.wp.com
sync.mathtag.com
sync.taboola.com
tlx.3lift.com
tpc.googlesyndication.com
trc.taboola.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.pe.com
x.bidswitch.net
x.dlx.addthis.com
z.moatads.com
geo.privacymanager.io
104.111.215.191
104.26.5.15
13.35.253.106
13.35.253.16
13.35.253.23
13.35.253.42
13.35.253.74
13.35.253.75
13.69.106.89
13.85.16.224
141.226.228.48
142.250.184.198
142.250.185.66
143.204.209.119
143.204.215.88
15.197.193.217
151.101.130.217
172.67.177.215
178.250.0.157
178.250.0.165
178.250.2.83
18.157.162.207
18.195.229.145
185.170.60.161
185.29.132.245
185.33.221.11
185.33.221.15
185.33.221.90
185.64.189.112
185.64.190.78
192.0.66.2
192.0.76.3
2.16.186.235
2.18.232.130
2.18.233.180
2.18.234.21
2.18.235.40
209.54.176.128
23.37.38.181
2600:1f18:444a:4602:b51a:2bef:14:5241
2600:1f18:730:b150:54c0:d5f0:3e0a:5e72
2600:9000:2057:3200:8:8845:1500:93a1
2600:9000:206f:3200:3:b7e:8940:93a1
2602:803:c003:200::51
2606:2800:233:1cb7:261b:1f9c:2074:3c
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2003
2a00:1450:4001:813::2002
2a00:1450:4001:827::2006
2a00:1450:4001:827::200a
2a00:1450:4001:828::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2002
2a00:1450:400e:810::2001
2a02:2638::1c
2a02:2638::3
2a02:26f0:1700:38a::11a6
2a02:26f0:7100:594::11a6
2a04:4e42:200::300
2a04:4e42:600::485
2a04:4e42:c00::282
2a05:d018:d29:3601:2114:2cbc:c6ab:b127
3.124.83.68
3.208.83.212
34.102.163.6
34.120.133.55
34.98.67.61
35.210.53.219
37.157.4.23
52.210.199.144
52.211.32.39
52.217.105.36
52.223.4.62
52.5.181.6
52.86.156.15
54.167.130.168
54.86.119.171
64.202.112.95
65.9.58.124
65.9.58.49
65.9.7.60
65.9.71.173
76.223.111.18
00f88d013f389b1b1fe37b653248847565cda56cd5e7b98242e4da7666d660e2
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
02e5d19a183da192e043987b408ccc29f42f512819fff85ba46f8a678dbb1773
039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d
0487a37bad6efd2f3dad258f1fc6ae821d5aab982f1cb542e2d12b7950b60259
04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
070df208d93f1efa73b5a3827c22257f4d0d9b53e8c425a699a4c5e82a75411e
072d1bc864528170fe2482258412b90093b58719bddbfd090d5a0217be32fd62
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
0dfec2daca0c9630407056545bec7c851250781cfc69637dbdb743a078670afa
0f2aac94d011ec45570ef1245e5fc8df73ebd09b1c6859c5a8393df5336e01b2
102ca8ad26b6f1f1a1652d9e39f40815a1cf9d9cdcf94e8ba412706097a5af79
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
133be2ab152b1c9f408e9a597430361539cf3b8255a0a92f8a8a8a885e079702
17e97000a009dcc5d7f0c9c5ad843306189593665fbd24f70332642d6c0f78b8
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18112e3d4932e8a808f1b4031c3b9a836f866608a1fd77e1a83f124098e45f17
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1cbc9bb25cf947ca1d54788a362c925bc377e4e7f283b73377ef5b2215e74773
1d3bed09ea42550f14c8721f27a7076c4f2a73692c1b8c3191a98c4d3603aace
1d4e66ef8f5ea94ffe457c995d263d41163c06c199cb6900dfc368b2214794a0
1ea03e7bb14df931f8a649756cffe9465c815aa0efc23acce14b50e21c3d20ad
20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
24bcc5ed9bdd0c9aee18cdde9c798a4b939d9918e46d2b2ba32739e643256ada
269ffb0e73cb3f4d5cf8845c23792191a461fd7d7a93f211191201104067ca5f
28cda65e3a24af65fa7752925888d02d531955c9e29b1f4133bd72ea91c9c018
2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5
2c39e5290ff0524d1b014847ad09d20bcdf39594d7a14fb3bf34e495bbb1a7d0
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675
2fcc3c30a10f35c852ff3d27a846dcde5c87dfe2b6c2abd7c2a58f67791f9df2
313e06542afcdab8e56d24b6677dc400b2d9d8a3e6650f1e05260e0148a84170
31a88b9695e5e8033bc8ce5c04a3a749c7bd59408f7ed6c18322f694c91a4474
3214c1d02f0794737b58d56814b31c639c67f85c6eb6816c39804cf5d4041dea
32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b
3ba33eb784e76cff5ade272712ed0e7b15d325196ec089aca7baa20e3034098a
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
43e37155805baaf45211de262abb39e0d274cc05229d9ffddac34d72852550ed
4e76c37aa7c3d8211fdbf11bdfb4ec6474220634bbf95df93e793d08ea2fc311
4eefdd923f73deeaec9e4ecb4cc3fae74379145f0fd3f5892165326bce8ed0ea
501b84d7db37a158e0313efd545c334fc75d82750e1248fa383321c67728b1ce
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51bbe57479b8c393497c12c8a7a3e3db77d4d60751017cbebd63ddc54a328819
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
5228ae8831708ab64be7336bc43ad5212731e82d78959f87768cf7343ef17056
5467e6d4fe4a88734e7946a3c6d94952cc1be7ef30b29030b9de45e6fae48e41
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
59c5af195c2e72b427de085a7120d003eabb6253ebdc5e17aa51111e43e414ef
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a
5b33d2430f45c3b1a26c31d1363740f0ffc5d05de3f531be8bf8a805cc46b6e1
5c9683881a019f750ab90c17902b9e7e1ae02397a0b1648b466c57388c4037d6
5ccbc882909280f350f1022342522cf327123c38f11d3124e894afbaf1deebbb
5ef86c111e8a3e6208263265a005c7379b8793ef6bc5c0a2a94454a1cb2e1f83
5f20e2f4399587ed6c61a043de2fb86314171eba2176d1788536ebe1ad01df5a
5f73db920d574a8ba16efc308a57e03f838227d4935e9892ec4d7403cf663517
60491e41ca279edb8cb82e9de2b860867f1e7b2373db30833769017f937d2ce2
60678bfba46c3541d231c87dfe3ec13b6e44813780edd999433ea13a7b443dd8
608c710dc12ffce0ce56bb5f5731c567456cfa23b9655f0524a8d2a6f03c4f24
61aa27d4d674b749c51e6ff3fbe7ab261e0f387e4b9c16ef23efabfeb09934bf
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62f87a6542a6942f6ef43d1a417556df6b40d4fdbc142631ee6506805ef1ff20
64ff9f874a5fd24a871b1d9cd7ee49e4d92bc27ce63c05e94bedc4f7adcc0a11
65da1116892245cea4c6a78ffdb5996468908b01050f06611d0be4dd33c0634e
66e6fad9e5ec87bcda3f169e68173f0d99c792ec94f8586d7df8a4edb540d1e5
69757be46f78d6c68d065feb5f72b9c4b4ac5370dea092873aad78c8ff8eaaf6
69bc82f0e59ed9185231ba115af336af7ccf89791a11330a3384c8e4492e6936
6f87d87de84dc36cab28965d9e1d940c250f399860acafe55f3dac01d54399ad
6fff2bb01836a52004ece484b97797926280251ccaed72db384f16a7644d4764
70c4634f438568a86bb98789e25bd251a5b979f0e1f68c57956f5c038f53a914
72c5d10e99c6620a2561415895a84064b5b5616c2b1914602263886be4cdc229
73a5c38561a9bef102be3b7b6278721916913075bce67f4600e6ca810d74b0c3
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a
7c748c638a73cf4c2a2e26751abd0c356073f77ad4aafb6def23c4d590b89ef5
7e3956138b4cca652bb3eda57d0f23d88a9038527421a120e6a536e75d7f895b
7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf
80e63f47bb601d1782367bf3015482e86cad9fa03cbfce5ec26502c016d4d47b
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
833af79fceebd91289eb5aac891019a7e5bd2a99f74fbd8d8430f52d6f908f2d
84c9c9d4de88f5cf5e9ed1803bc3dc4a3a60be607d5b1d1c690151144e6a8a5c
8576ac4fad8d6a2eef6c1a412387cb3e7a6909b0a647f33bb0686d57d300d02e
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
881179ed8d76a220dc210c45af07c46373896683c0d394f1595cd7213cb4d7ba
8868b36a770f59e31cc285b79ec2cc7bf648bd03a8fba7891c3119431c165d57
89e5f27ec88b0725701cd952755856b8596ff4e3d8313fbaecf1abbdfdfb5f7d
8a170f5913eecb1afeda4cccca5d5b9589c8f068a04ae2c517b602e1484982b4
8cf0bb9486df56f8bfc90a4ba4d7317243f9ca37aa6ec6193214e9a0d640744c
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e1d83fc266714550c54c8b2f455921c23ded54ba23ffdd044444534303005ad
8e1fec0a84e61e269e979fcd14494dcf692ac68379e6ec94c1c36398dbca8b11
8eedfc1e0ed881b31e0ba53a1c5c8aa79e795dd75caa5b9e8f1dd68a9a22f14d
8eef13347d64e2477c4e752050f29eadf8394eb260d67307240a44bece27d654
90fa0859cb41aad24ca115ac15af214660b026692c926eb00a510793f1a91f06
92bcab164dffebb0925797ce70407a8e16b78cedf78621f226ef8fdc824b663a
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9455c17f04895c082b78aad0133bb5222671817dfcd4b8bfb1211746f5e5cae2
96432f7a764d600eb5d35cfefa51fbb8e3aa62bafea3bb3fc08225403837124a
96b34914f736b96f184920bea4cf3b30a7b76583c51bf1e9caf2add39705bffd
97816b3ca3d676b5241a16fd6fb3f3e4050a3b99c914f0a66f0bcc074617ba80
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99bea1588717259aa23413b0659c1eb6a0fe227b10eb213e8d9068fd1aa23b96
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99ff0f06144001dc0b81b59a9c58560585a9567ebde6e9f465fab855929263e3
9a83205ed8814f5032e98f82fdbaf746235da936ce6d8d2b79c60fd611a6ebea
9c27626364eeaffb44ad2decb980dace7bedb3c8ea1575f81927fc9409cb5b49
9d7ae5b7196c72a8c09f3a766e06e61b2ef1d6192076016838b479136435b678
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee
a39c434ed12e9707bff709c0cdb94247ab1468dbed0fd4db5250d59051c501f2
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
a7193b4a580e14658a91dd634cc0ef32ebccae115e311886a993b5e07ca5102d
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e
acaafa483082b15ca0cb2d8a12867951880242e7ec0ea53b17843bd06d968c24
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f
b2001efa6a71924d67fcb58760986b8b6c01b865b0f94d1be43e5088b1550ffe
b26c8bbdb2299a7b5b4ee088ed48e7e1c7bfc23a1a0ff351648859108b1ff982
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b4f31178f3fe6003e606295047fdb9be890c6a9c6c8594576435f86975af582f
b6314c8400868242589514cba66862e787c8ec59275942e0417a65f821a0a976
b671e2140966063715d21667867d60de45adc723cd1b31e0d2f7466105a90247
b6a26d9387f340a97733c16fb917032a810679a11820112b0e592a5c90ceb2af
b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b
b95b7840dd4e76f60f9b3d9c3a7dcff21135b740611568ab4044853964694fec
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcc12496cca31bf3ce07009f2b035c7405081719cc9bcc534e1272649c6afd9f
bdec589d8782fb514fb6e818e16cd184f20681bb3a77155cba33f02e004bb1a4
bf46d5d914dccddc7da53f756e095a4357e4f0b84bdffe36f26d8d58d2d18f69
c2168fa195790fd53543640ff32c2e008ab5e3bbf3034ad87d5188b7a18e3aba
c2cb797c032b97fe5bf080e4d0e2537fd7f9a78e8ccc3fb8c4c5bc8ca7415e04
c393abbd75cd3ab5b3d3e38af1e75fe647a95b2997ac480e534575daad35d125
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16
c93ebc110b1a1000cc387bee74dcd5acb7f1569a4d0aa9403cc178acf4b24ab0
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cad03ccdac0d4de0806a5523bc216329edfce0fdde0a15900c37601bd5c378e5
d13bd7a1939b9e45e1f75b0b0e30689a445a11b84a6301cec4e457434407ae10
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d29ba8261f9c7f72b9d0eb745cf51e0efea0697a37b99107921eeb26e5dbd844
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d3460d76a3013a4bb9c689877b41f3eadbf5e780ed9230fb8f8bbd16fcc59842
d348f499cc107421f1673e9a3a84606a3db6d4cb0ba0ad903c5f59142ede9db4
d607276921f83d94b7a664e718fb8f540ce38b028ec4aab9926df5ea97330bd7
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
dbae94cba2ba3d07d6ae6e79a7c60c4efc36deb442e193ab18e0fd0cd4d97eef
dc7a07d5c4d96d1a7458827b6feff4d2519e75ed313d741abdcebadd394d3ae9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd1b5e04d54c4420fe3e8e6abe2875fc7f13a3cd6384b6c2afc1a35e302dd846
dd50ba290f74d344ad0d04ade63c55b02360bf4db99c0a2749f34deb0c8dcec9
dde5f5e3043fff6c7a7f24a307eac6ac7317e7d6db0085fbbe268eb11ba08699
de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185
dea5d8ba9e54379b26e109f61ceba20a0781d4f80eed75fce6ad0993d4784195
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df544db2e8b010512a5ec168d3a9b91355c7197d04a1b29325510e29405e6e0f
e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e1e2c69415d3ce981eb39442df8b7ed7cab80814de7de473d486669c926fab18
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
e371c9ea0fd636a3ecd29ae5e8413d144d470f77ca4bdda94b6e61ec3b980eb9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc
e80c9b8012ae8a982791e1d587b648ad62640e358e405b25a47ae45ac61b8bd7
e878e3e995e89c125a8187b3af26ec48cc6e89c48709316d5389e4066d7ceb5e
ea5d2befb0a4e0ce54a1e5014b440dcbec8a981df5921805bef7c080647dab6d
eb6a55ea38606e49f7032e06104cafae04f0367c37fe7e84259473e27abc2df1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2d9a53e91a8981e54ce5e3372aef2905f9a7b2789f30bb28f212198a637f997
f3260225ba132e9bf8956514e81f6136265ee05250271a027bb2029cbbf4651d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3a8ee9d81a2ecb7d3c5026edae0d3a9cf07de5dd002c0163c6891f48edc5da5
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc1c59f24e8ddfd6ba5b1c98d9c1aecd31d2b2884c9ab7bed98af70c3f12dd29
fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc

www.pe.com Open in urlscan Pro 192.0.66.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

243 Requests

89 %HTTPS

33 %IPv6

62 Domains

97 Subdomains

79 IPs

9 Countries

3603 kBTransfer

12564 kBSize

57 Cookies

41 Outgoing links

Redirected requests

243 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.pe.com Open in urlscan Pro
192.0.66.2 Public Scan

Screenshot
Live screenshot

Full Image

243
Requests

89 %
HTTPS

33 %
IPv6

62
Domains

97
Subdomains

79
IPs

9
Countries

3603 kB
Transfer

12564 kB
Size

57
Cookies

243 HTTP transactions
4 data transactions