herbeauty.co Open in urlscan Pro
2606:4700:4400::6812:2b55 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzx...
Effective URL:
https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&ut...
Submission: On June 19 via api (June 19th 2024, 3:00:36 pm UTC) from US — Scanned from DE

Summary HTTP 41 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 17 domains to perform 41 HTTP transactions. The main IP is 2606:4700:4400::6812:2b55, located in and belongs to . The main domain is herbeauty.co.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 22nd 2023. Valid for: a year.

This is the only time herbeauty.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4 7	173.214.240.15 173.214.240.15	15317 (SERVEREL-AS) (SERVEREL-AS)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
3 3	199.182.164.180 199.182.164.180	15317 (SERVEREL-AS) (SERVEREL-AS)
1 3	104.19.133.76 104.19.133.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	172.64.152.106 172.64.152.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:986a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
1 1	104.19.132.76 104.19.132.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2b55	() ()
41	8

7 173.214.240.15 (United States) 4 redirects

ASN15317 (SERVEREL-AS, US)
PTR: 173.214.240.15.serverel.net

spectrumtop5.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
freetrckr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newssage4.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.182.164.180 (United States) 3 redirects

ASN15317 (SERVEREL-AS, US)
PTR: 180.164.182.199.serverel.net

xml.pushking.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.19.133.76 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

c.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.152.106 (San Francisco, United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

c.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
clck.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:986a (United States)

ASN13335 (CLOUDFLARENET, US)

s-img.adskeeper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.132.76 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

clck.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2b55 (None, )

ASN- ()

herbeauty.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	newssage4.xyz 2 redirects newssage4.xyz	3 KB
4	adskeeper.com 2 redirects c.adskeeper.com — Cisco Umbrella Rank: 29618 s-img.adskeeper.com — Cisco Umbrella Rank: 27266 clck.adskeeper.com — Cisco Umbrella Rank: 129066	86 KB
4	mgid.com 2 redirects c.mgid.com — Cisco Umbrella Rank: 5892 s-img.mgid.com — Cisco Umbrella Rank: 8542 clck.mgid.com — Cisco Umbrella Rank: 37550 jsc.mgid.com Failed	48 KB
3	pushking.net 3 redirects xml.pushking.net — Cisco Umbrella Rank: 65344	2 KB
2	gstatic.com fonts.gstatic.com	31 KB
1	herbeauty.co herbeauty.co img-cdn.herbeauty.co Failed
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	1 KB
1	freetrckr.com 1 redirects freetrckr.com — Cisco Umbrella Rank: 672301	338 B
1	spectrumtop5.xyz 1 redirects spectrumtop5.xyz	120 B
0	gravatar.com Failed secure.gravatar.com Failed
0	shinystat.com Failed codice.shinystat.com Failed
0	skimresources.com Failed s.skimresources.com Failed
0	googletagmanager.com Failed www.googletagmanager.com Failed
0	unpkg.com Failed unpkg.com Failed
0	googlesyndication.com Failed pagead2.googlesyndication.com Failed
0	usefulcontentsites.com Failed cdn.usefulcontentsites.com Failed
0	cookielaw.org Failed cdn.cookielaw.org Failed
41	17

	Domain	Requested by
5	newssage4.xyz	2 redirects newssage4.xyz
3	xml.pushking.net	3 redirects
2	fonts.gstatic.com	fonts.googleapis.com
2	s-img.adskeeper.com	newssage4.xyz
2	s-img.mgid.com	newssage4.xyz
1	herbeauty.co	newssage4.xyz herbeauty.co
1	clck.mgid.com	1 redirects
1	clck.adskeeper.com	1 redirects
1	c.adskeeper.com	1 redirects
1	c.mgid.com	1 redirects
1	fonts.googleapis.com	newssage4.xyz
1	freetrckr.com	1 redirects
1	spectrumtop5.xyz	1 redirects
0	secure.gravatar.com Failed	herbeauty.co
0	jsc.mgid.com Failed	herbeauty.co
0	img-cdn.herbeauty.co Failed	herbeauty.co
0	codice.shinystat.com Failed	herbeauty.co
0	s.skimresources.com Failed	herbeauty.co
0	www.googletagmanager.com Failed	herbeauty.co
0	unpkg.com Failed	herbeauty.co
0	pagead2.googlesyndication.com Failed	herbeauty.co
0	cdn.usefulcontentsites.com Failed	herbeauty.co
0	cdn.cookielaw.org Failed	herbeauty.co
41	23

This site contains no links.

Subject Issuer	Validity	Valid
wordbazar4.xyz R3	`2024-05-21` - `2024-08-19`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
mgid.com E1	`2024-05-09` - `2024-08-07`	3 months	crt.sh
adskeeper.com GTS CA 1P5	`2024-05-24` - `2024-08-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
herbeauty.co Cloudflare Inc ECC CA-3	`2023-10-22` - `2024-10-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&utm_source=herbeauty.co_desk_de&utm_campaign=herbeauty.co_desk_de&utm_term=57965539s3847&utm_content=18707334&adclid=52d5b8e2ea4b5d941678bf8ed38e0a33
Frame ID: 9C6A15A7D7053B4F555368DAD97BF6AD
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymi... HTTP 307
https://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymi... HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0Ew... Page URL
https://xml.pushking.net/click?s=1&tid=534&sid=91e53e6f98527c09b9233c575b813003&rnd=34191983 HTTP 302
https://clck.adskeeper.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxi... HTTP 301
https://clck.mgid.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxi... HTTP 301
https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verander... Page URL

Page Statistics

41
Requests

22 %
HTTPS

44 %
IPv6

17
Domains

23
Subdomains

8
IPs

3
Countries

166 kB
Transfer

236 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmwfknjfhztkyyzetmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1718645500894&rnd=11115849&j...~311~...tx3nxx2fsbf9mciuymiu3ra==&if=1 HTTP 307
https://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmwfknjfhztkyyzetmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1718645500894&rnd=11115849&j...~311~...tx3nxx2fsbf9mciuymiu3ra==&if=1 HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D Page URL
https://xml.pushking.net/click?s=1&tid=534&sid=91e53e6f98527c09b9233c575b813003&rnd=34191983 HTTP 302
https://clck.adskeeper.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ*&rid=ac567410-2e4c-11ef-b41e-c84bd68370c0&tt=Direct&att=3&pubsrcid=1988525521&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT523qmMjFh_0rjea0Jt5uxsOZnn_umJOxMgRJ HTTP 301
https://clck.mgid.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ%2A&rid=ac567410-2e4c-11ef-b41e-c84bd68370c0&tt=Direct&att=3&pubsrcid=1988525521&cpm=1&ct=1&st=120&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT523qmMjFh_0rjea0Jt5uxsOZnn_umJOxMgRJ&rdrct=1 HTTP 301
https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&utm_source=herbeauty.co_desk_de&utm_campaign=herbeauty.co_desk_de&utm_term=57965539s3847&utm_content=18707334&adclid=52d5b8e2ea4b5d941678bf8ed38e0a33 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmwfknjfhztkyyzetmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1718645500894&rnd=11115849&j...~311~...tx3nxx2fsbf9mciuymiu3ra==&if=1 HTTP 307
https://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmwfknjfhztkyyzetmzi4ni0wljawmdmxnyuymiu1rcu3ra%3d%3d&t=1718645500894&rnd=11115849&j...~311~...tx3nxx2fsbf9mciuymiu3ra==&if=1 HTTP 302
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Request Chain 2

https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_3285_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDA0OGZjMTVjOGRhNjhkMDAzMjA1MTQwY2E3YTIxNTUzJTI2cm5kJTNENDEyODgxNTA0&t=1718809232291&rnd=454028540&i=1 HTTP 302
https://xml.pushking.net/icon?sid=048fc15c8da68d003205140ca7a21553&rnd=412881504 HTTP 302
https://c.mgid.com/c?pv=2&v=0|0|0|nuqjGz8I2OsoLZcd4Yy4wAkZ-bkeF-NrG_-6JwxhV9pdoTxMSo8tDJ1t3dnDqn2ST7Yjim-xUWGVXYTAlDWduiveFVW5J8ygM_mfCU8J7tQ*&cid=1423484&f=1&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT523qmMjFh_0rjea0Jt5uxsOZnn_umJOxMgRJ&rid=ac569cee-2e4c-11ef-b41e-c84bd68370c0&psid=885255&iub=aHR0cHM6Ly9zLWltZy5tZ2lkLmNvbS9nLzE4OTIxMTY0LzMyOHgzMjgvLS9hSFIwY0RvdkwyTnNMbWx0WjJodmMzUnpMbU52YlM5cGJXZG9MMmx0WVdkbEwyWmxkR05vTDJGeVh6RTZNU3hqWDJacGJHd3NaVjl6YUdGeWNHVnVPakV3TUN4bVgycHdaeXhuWDJaaFkyVnpPbUYxZEc4c2NWOWhkWFJ2T21kdmIyUXNkMTg1TmpBdmFIUjBjRG92TDJsdFoyaHZjM1J6TG1OdmJTOTBMekl3TWpRdE1ETXZOekU1TmpjekwyUXdNalpsT0dJNE9HRTVPVFppT0dNM09HWmtPVGRqTURVME1qTTVNRGc0TG1wd1p3LndlYnA_dj0xNzE4ODA5MjMxLXhaWjdwdTVtMGtSYVRIb1JXektuOC04cUhBeGUzTHFSNHphTkV5NEhhdFE= HTTP 301
https://s-img.mgid.com/g/18921164/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczL2QwMjZlOGI4OGE5OTZiOGM3OGZkOTdjMDU0MjM5MDg4LmpwZw.webp?v=1718809231-xZZ7pu5m0kRaTHoRWzKn8-8qHAxe3LqR4zaNEy4HatQ

Request Chain 3

https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_3975_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDkxZTUzZTZmOTg1MjdjMDliOTIzM2M1NzViODEzMDAzJTI2cm5kJTNENDEyODgxNTA0&t=1718809232291&rnd=935091120&i=1 HTTP 302
https://xml.pushking.net/icon?sid=91e53e6f98527c09b9233c575b813003&rnd=412881504 HTTP 302
https://c.adskeeper.com/c?pv=2&v=0|0|0|nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ*&cid=1634622&f=1&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT523qmMjFh_0rjea0Jt5uxsOZnn_umJOxMgRJ&rid=ac567410-2e4c-11ef-b41e-c84bd68370c0&psid=1988525521&iub=aHR0cHM6Ly9zLWltZy5hZHNrZWVwZXIuY29tL2cvMTg3MDczMzQvMzI4eDMyOC8tL2FIUjBjRG92TDJOc0xtbHRaMmh2YzNSekxtTnZiUzlwYldkb0wybHRZV2RsTDJabGRHTm9MMkZ5WHpFNk1TeGpYMlpwYkd3c1pWOXphR0Z5Y0dWdU9qRXdNQ3htWDJwd1p5eG5YMlpoWTJWek9tRjFkRzhzY1Y5aGRYUnZPbWR2YjJRc2QxODVOakF2YUhSMGNEb3ZMMmx0WjJodmMzUnpMbU52YlM5MEx6SXdNalF0TURJdk1UQXhPVEkwTDJZelltUTFZelF5WVRkbFptRm1NVE13T1dFNE1EY3pObVE1Wm1SbVpEVTVMbXB3WldjLndlYnA_dj0xNzE4ODA5MjMxLVo4MERYUUZzRlhCYW5mWXRMWXV3VnVOM0pCbjRMc3FTZ3JJWnUybld0NVE= HTTP 301
https://s-img.adskeeper.com/g/18707334/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvMTAxOTI0L2YzYmQ1YzQyYTdlZmFmMTMwOWE4MDczNmQ5ZmRmZDU5LmpwZWc.webp?v=1718809231-Z80DXQFsFXBanfYtLYuwVuN3JBn4LsqSgrIZu2nWt5Q

41 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js Show response
newssage4.xyz/
Redirect Chain

http://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmwf...
https://spectrumtop5.xyz/event_31c54894-78ff-730d-744c-a79ee49e7f41_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytywi0m2i1yzbjowi0otazy2ixzgzkmw...
https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

6 KB
2 KB

592ms
184ms

Document
text/html

173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: cdd0ef5f03074a7ace1942163eb22bb9ffaace3748075ab97bca6bbbc206bc9b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 19 Jun 2024 15:00:32 GMT
server: nginx

Redirect headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-WoW64, Sec-CH-UA-Bitness, Sec-CH-UA-Model
date: Wed, 19 Jun 2024 15:00:31 GMT
location: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
server: nginx

GET
H2 200 css
fonts.googleapis.com/ 6 KB
1 KB 83ms
31ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Requested by

Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://newssage4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 19 Jun 2024 15:00:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 19 Jun 2024 14:06:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jun 2024 15:00:32 GMT

GET
H3

200

aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczL2QwMjZlO...
s-img.mgid.com/g/18921164/328x328/-/
Redirect Chain

https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_3285_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDA0OGZjMTVjOGRhNjhkMDAzMjA1MTQwY2E3YTIxNTUzJTI2cm...
https://xml.pushking.net/icon?sid=048fc15c8da68d003205140ca7a21553&rnd=412881504
https://c.mgid.com/c?pv=2&v=0|0|0|nuqjGz8I2OsoLZcd4Yy4wAkZ-bkeF-NrG_-6JwxhV9pdoTxMSo8tDJ1t3dnDqn2ST7Yjim-xUWGVXYTAlDWduiveFVW5J8ygM_mfCU8J7tQ*&cid=1423484&f=1&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT523qmMj...
https://s-img.mgid.com/g/18921164/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ...

23 KB
24 KB

46ms
46ms

Image
image/webp

104.19.133.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-img.mgid.com/g/18921164/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczL2QwMjZlOGI4OGE5OTZiOGM3OGZkOTdjMDU0MjM5MDg4LmpwZw.webp?v=1718809231-xZZ7pu5m0kRaTHoRWzKn8-8qHAxe3LqR4zaNEy4HatQ

Requested by

Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Server

104.19.133.76 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

132cd3518363a09fe20868a435b7f2453fdb2e0f00f6c1bd48c42a27374b6f1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://newssage4.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 19 Jun 2024 15:00:33 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
x-mg-request-uuid: a91a2602-7c8b-4551-8a52-14674dd772fe
age: 683256
alt-svc: h3=":443"; ma=86400
content-length: 23952
last-modified: Mon, 27 May 2024 10:19:48 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 896463ab8ff6bbf1-FRA

Redirect headers

date: Wed, 19 Jun 2024 15:00:33 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-mg-request-uuid: 754d4ef3-c28a-42ba-a75e-cf0013ff3737
server: cloudflare
location: https://s-img.mgid.com/g/18921164/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDMvNzE5NjczL2QwMjZlOGI4OGE5OTZiOGM3OGZkOTdjMDU0MjM5MDg4LmpwZw.webp?v=1718809231-xZZ7pu5m0kRaTHoRWzKn8-8qHAxe3LqR4zaNEy4HatQ
cf-ray: 896463ab4f62bbf1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3

200

aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvMTAxOTI0L2YzYmQ1Y...
s-img.adskeeper.com/g/18707334/328x328/-/
Redirect Chain

https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_3975_3000?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDkxZTUzZTZmOTg1MjdjMDliOTIzM2M1NzViODEzMDAzJTI2cm...
https://xml.pushking.net/icon?sid=91e53e6f98527c09b9233c575b813003&rnd=412881504
https://c.adskeeper.com/c?pv=2&v=0|0|0|nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ*&cid=1634622&f=1&h2=vlJ0RdnMYFlD0pCQy6adPjLFZzOT52...
https://s-img.adskeeper.com/g/18707334/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDov...

40 KB
40 KB

60ms
60ms

Image
image/webp

172.64.152.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.com/g/18707334/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvMTAxOTI0L2YzYmQ1YzQyYTdlZmFmMTMwOWE4MDczNmQ5ZmRmZDU5LmpwZWc.webp?v=1718809231-Z80DXQFsFXBanfYtLYuwVuN3JBn4LsqSgrIZu2nWt5Q
Requested by: Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H3
Server: 172.64.152.106 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff71185bebfc18fea490956425ee078fb91cb096806897237bee67a1a72546d0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://newssage4.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 19 Jun 2024 15:00:33 GMT
cf-cache-status: HIT
last-modified: Fri, 23 Feb 2024 20:36:52 GMT
x-mg-request-uuid: 92bfda4d-b349-4799-90fe-53a2d9ccb409
server: cloudflare
age: 1070808
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 896463abd9b5b5f1-WAW
content-length: 41050
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 19 Jun 2024 15:00:33 GMT
strict-transport-security: max-age=15768000; includeSubdomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-mg-request-uuid: c7ba5b93-c771-4df4-a3e1-7ef5523bb8e9
server: cloudflare
location: https://s-img.adskeeper.com/g/18707334/328x328/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd185NjAvaHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjQtMDIvMTAxOTI0L2YzYmQ1YzQyYTdlZmFmMTMwOWE4MDczNmQ5ZmRmZDU5LmpwZWc.webp?v=1718809231-Z80DXQFsFXBanfYtLYuwVuN3JBn4LsqSgrIZu2nWt5Q
cf-ray: 896463ab386cb5f1-WAW
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAzLzcxOTY3My9kMDI2Z...
s-img.mgid.com/g/18921164/453x227/-/ 22 KB
23 KB 95ms
61ms Image
image/webp 104.19.133.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s-img.mgid.com/g/18921164/453x227/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAzLzcxOTY3My9kMDI2ZThiODhhOTk2YjhjNzhmZDk3YzA1NDIzOTA4OC5qcGc.webp?v=1718809231-wwe4MiBD7efhjETNd3-x-Q0HWRfoWVIOLB2_JrjD6rY

Requested by

Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.133.76 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

954c18182661b34804445c033fef8cde055866cec47a41effd7653dfbe367ab3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://newssage4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 15:00:32 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
x-mg-request-uuid: 4008be42-5156-4bb9-b928-d51ad4851cf1
age: 1658388
alt-svc: h3=":443"; ma=86400
content-length: 22718
last-modified: Thu, 23 May 2024 00:47:41 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 896463a73802bbf1-FRA

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAyLzEwMTkyNC9mM2JkN...
s-img.adskeeper.com/g/18707334/453x227/-/ 44 KB
44 KB 118ms
66ms Image
image/webp 2606:4700:4400::ac40:986a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.adskeeper.com/g/18707334/453x227/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzI6MSxjX2ZpbGwsZV9zaGFycGVuOjEwMCxmX2pwZyxnX2ZhY2VzOmF1dG8scV9hdXRvOmdvb2Qsd18xMDIwL2h0dHA6Ly9pbWdob3N0cy5jb20vdC8yMDI0LTAyLzEwMTkyNC9mM2JkNWM0MmE3ZWZhZjEzMDlhODA3MzZkOWZkZmQ1OS5qcGVn.webp?v=1718809231-x0MsjhFMKvacwN_9TjrB5_nUAPFPsUf_mosPWKezPW4
Requested by: Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:986a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43f53b38a9bb64d7d391f15fdf98ace93e866a0dc3d92fac093b60dfbacd928b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://newssage4.xyz/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 15:00:32 GMT
cf-cache-status: HIT
last-modified: Fri, 23 Feb 2024 20:51:31 GMT
x-mg-request-uuid: 13e8bc1c-efd0-4009-a9c5-3f808ae24252
server: cloudflare
age: 8057006
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
cf-ray: 896463a75c378f31-FRA
content-length: 44776
alt-svc: h3=":443"; ma=86400

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 73ms
25ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://newssage4.xyz
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 14:50:02 GMT
x-content-type-options: nosniff
age: 87030
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 14:50:02 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 67ms
20ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://newssage4.xyz
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 14:43:19 GMT
x-content-type-options: nosniff
age: 87433
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 14:43:19 GMT

GET
H2 404 favicon.ico
newssage4.xyz/ 548 B
245 B 186ms
185ms Other
text/html 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://newssage4.xyz/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 15:00:33 GMT
content-encoding: gzip
server: nginx
content-type: text/html

GET
H2 200 event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_0_3000 Show response
newssage4.xyz/ 116 B
208 B 184ms
184ms Script
application/javascript 173.214.240.15
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_0_3000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTA0OGZjMTVjOGRhNjhkMDAzMjA1MTQwY2E3YTIxNTUzLTMyODUtMC4wMDAzMTclMjIlMkMlMjI1MzQtOTFlNTNlNmY5ODUyN2MwOWI5MjMzYzU3NWI4MTMwMDMtMzk3NS0wLjAwNDAzMyUyMiU1RCU3RA%3D%3D&t=1718809232291&rnd=259909128&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Requested by: Host: newssage4.xyz
URL: https://newssage4.xyz/sw_9c3b545c-d05a-65f1-a69a-d3c2ac8ebdfa_101_0_3000.js?h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS: 173.214.240.15.serverel.net
Software: nginx /
Resource Hash: d78e7ce890aa001f9082e162ce796125ffd49a12b05cd5508c4b790b8d3ec053

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 15:00:34 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript

GET
H2

200

Primary Request /
herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/
Redirect Chain

https://xml.pushking.net/click?s=1&tid=534&sid=91e53e6f98527c09b9233c575b813003&rnd=34191983
https://clck.adskeeper.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ*&rid=ac567410-2e...
https://clck.mgid.com/ghits/18707334/i/57965539/2/src/3847/pp/1/1?h=nuqjGz8I2OsoLZcd4Yy4wPKzfILjxikfKiEWozV-6otSdelFtWldkmCqPCjifWWaT7Yjim-xUWGVXYTAlDWdunpRko9rauaLq5icc9jelHQ%2A&rid=ac567410-2e4c-...
https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&utm_source=herbeauty.co_desk_de&utm_campaign=herbeauty.co_desk_de&utm_term=5796553...

63 KB
0

851ms
788ms

Document
text/html

2606:4700:4400::6812:2b55

General

Check archive.org

Show headers Download Go to

Full URL: https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&utm_source=herbeauty.co_desk_de&utm_campaign=herbeauty.co_desk_de&utm_term=57965539s3847&utm_content=18707334&adclid=52d5b8e2ea4b5d941678bf8ed38e0a33
Requested by: Host: newssage4.xyz
URL: https://newssage4.xyz/event_5d4c0519-7d07-82bd-a9e7-9e6e88cda79f_101_0_3000?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyNTM0LTA0OGZjMTVjOGRhNjhkMDAzMjA1MTQwY2E3YTIxNTUzLTMyODUtMC4wMDAzMTclMjIlMkMlMjI1MzQtOTFlNTNlNmY5ODUyN2MwOWI5MjMzYzU3NWI4MTMwMDMtMzk3NS0wLjAwNDAzMyUyMiU1RCU3RA%3D%3D&t=1718809232291&rnd=259909128&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2b55 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 896463badab67185-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 19 Jun 2024 15:00:36 GMT
link: <https://herbeauty.co/wp-json/>; rel="https://api.w.org/" <https://herbeauty.co/wp-json/wp/v2/posts/98448>; rel="alternate"; type="application/json" <https://herbeauty.co/?p=98448>; rel=shortlink
server: cloudflare
x-fastcgi-cache: BYPASS

Redirect headers

accept-ch: sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-wow64,sec-ch-ua-bitness,sec-ch-ua-model
alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 896463b9be5f1e10-FRA
content-type: text/html; charset=UTF-8
date: Wed, 19 Jun 2024 15:00:35 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
location: https://herbeauty.co/de/unterhaltung/danni-buchner-fruher-und-heute-sie-hat-sich-radikal-verandert/?utm_medium=cpc&utm_source=herbeauty.co_desk_de&utm_campaign=herbeauty.co_desk_de&utm_term=57965539s3847&utm_content=18707334&adclid=52d5b8e2ea4b5d941678bf8ed38e0a33
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-mg-click-uuid: d96ebaf8-2264-fbe1-12fa-242474ab64cc
x-robots-tag: noindex

GET otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 0
0

GET usefulcontentsites-subscribe.js
cdn.usefulcontentsites.com/js/push/ 0
0

GET adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 0
0

GET aos.css
unpkg.com/aos@2.3.1/dist/ 0
0

GET style.min.css
herbeauty.co/wp-includes/css/dist/block-library/ 0
0

GET frontend.min.css
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/css/ 0
0

GET flatpickr.min.css
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 0
0

GET select2.min.css
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/select2/ 0
0

GET style.css
herbeauty.co/wp-content/themes/best-minimalist/ 0
0

GET minimalist.css
herbeauty.co/wp-content/themes/best-minimalist/assets/css/ 0
0

GET jquery.min.js
herbeauty.co/wp-includes/js/jquery/ 0
0

GET jquery-migrate.min.js
herbeauty.co/wp-includes/js/jquery/ 0
0

GET flatpickr.min.js
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 0
0

GET select2.min.js
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/select2/ 0
0

GET main.js
herbeauty.co/wp-content/themes/best-minimalist/assets/js/ 0
0

GET js
www.googletagmanager.com/gtag/ 0
0

GET 114581X1575936.skimlinks.js
s.skimresources.com/js/ 0
0

GET getcod.cgi
codice.shinystat.com/cgi-bin/ 0
0

GET hb_logo-1.png
img-cdn.herbeauty.co/wp-content/uploads/2021/02/ 0
0

GET 1-8.jpg
img-cdn.herbeauty.co/wp-content/uploads/2021/08/ 0
0

GET herbeauty.co.1415255.js
jsc.mgid.com/h/e/ 0
0

GET 2-4-1024x683.jpg
img-cdn.herbeauty.co/wp-content/uploads/2021/08/ 0
0

GET 3-1024x576.jpeg
img-cdn.herbeauty.co/wp-content/uploads/2021/08/ 0
0

GET /
secure.gravatar.com/avatar/ 0
0

GET herbeauty.co.1476650.js
jsc.mgid.com/h/e/ 0
0

GET herbeauty.co.1054420.js
jsc.mgid.com/h/e/ 0
0

GET end.js
herbeauty.co/wp-content/themes/best-minimalist/assets/js/ 0
0

GET frontend.min.js
herbeauty.co/wp-content/plugins/wp-user-avatar/assets/js/ 0
0

GET navigation.js
herbeauty.co/wp-content/themes/best-minimalist/assets/js/ 0
0

GET skip-link-focus-fix.js
herbeauty.co/wp-content/themes/best-minimalist/assets/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Domain: cdn.usefulcontentsites.com
URL: https://cdn.usefulcontentsites.com/js/push/usefulcontentsites-subscribe.js?v=7

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Domain: unpkg.com
URL: https://unpkg.com/aos@2.3.1/dist/aos.css

Domain: herbeauty.co
URL: https://herbeauty.co/wp-includes/css/dist/block-library/style.min.css?ver=6.3.2

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css?ver=4.13.4

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css?ver=4.13.4

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css?ver=6.3.2

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/style.css?ver=6.3.2

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/assets/css/minimalist.css?ver=6.3.2

Domain: herbeauty.co
URL: https://herbeauty.co/wp-includes/js/jquery/jquery.min.js?ver=3.7.0

Domain: herbeauty.co
URL: https://herbeauty.co/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js?ver=4.13.4

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js?ver=4.13.4

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/assets/js/main.js?ver=1

Domain: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WG9PLY6B61

Domain: s.skimresources.com
URL: https://s.skimresources.com/js/114581X1575936.skimlinks.js

Domain: codice.shinystat.com
URL: https://codice.shinystat.com/cgi-bin/getcod.cgi?USER=SS-44258713-3958a

Domain: img-cdn.herbeauty.co
URL: https://img-cdn.herbeauty.co/wp-content/uploads/2021/02/hb_logo-1.png

Domain: img-cdn.herbeauty.co
URL: https://img-cdn.herbeauty.co/wp-content/uploads/2021/08/1-8.jpg

Domain: jsc.mgid.com
URL: https://jsc.mgid.com/h/e/herbeauty.co.1415255.js

Domain: img-cdn.herbeauty.co
URL: https://img-cdn.herbeauty.co/wp-content/uploads/2021/08/2-4-1024x683.jpg

Domain: img-cdn.herbeauty.co
URL: https://img-cdn.herbeauty.co/wp-content/uploads/2021/08/3-1024x576.jpeg

Domain: secure.gravatar.com
URL: https://secure.gravatar.com/avatar/?s=96&d=mm&r=g

Domain: jsc.mgid.com
URL: https://jsc.mgid.com/h/e/herbeauty.co.1476650.js

Domain: jsc.mgid.com
URL: https://jsc.mgid.com/h/e/herbeauty.co.1054420.js

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/assets/js/end.js

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=4.13.4

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/assets/js/navigation.js?ver=20151215

Domain: herbeauty.co
URL: https://herbeauty.co/wp-content/themes/best-minimalist/assets/js/skip-link-focus-fix.js?ver=20151215

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mgid.com/	1970-01-20 21:26:51	Name: __cf_bm Value: _756womSD.h3SOS3c3wwWU_FCMO0Dvkn4wRD.UgEmTs-1718809232-1.0.1.1-BFsHV8xI6Gz4xQR7zkr4EVpPllvlUfmM10GbfRliGYhCjHmAUucsdxs6uqEm.8MQKo8DaSVRdNrnrY1HI2Mg0g
.adskeeper.com/	1970-01-20 21:28:15	Name: mgid Value: 18707334
.adskeeper.com/	1970-01-20 21:28:15	Name: mtid Value: 57965539
.adskeeper.com/	1970-01-20 21:28:15	Name: mtuid Value: 57965539s3847
.adskeeper.com/	1970-01-20 21:28:15	Name: mstatus Value: 0
.adskeeper.com/	1970-01-20 21:28:15	Name: mghd Value: herbeauty.co
.mgid.com/	1970-01-20 21:28:15	Name: mgid Value: 18707334
.mgid.com/	1970-01-20 21:28:15	Name: mtid Value: 57965539
.mgid.com/	1970-01-20 21:28:15	Name: mtuid Value: 57965539s3847
.mgid.com/	1970-01-20 21:28:15	Name: mstatus Value: 0
.mgid.com/	1970-01-20 21:28:15	Name: mghd Value: herbeauty.co

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://newssage4.xyz/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.adskeeper.com
c.mgid.com
cdn.cookielaw.org
cdn.usefulcontentsites.com
clck.adskeeper.com
clck.mgid.com
codice.shinystat.com
fonts.googleapis.com
fonts.gstatic.com
freetrckr.com
herbeauty.co
img-cdn.herbeauty.co
jsc.mgid.com
newssage4.xyz
pagead2.googlesyndication.com
s-img.adskeeper.com
s-img.mgid.com
s.skimresources.com
secure.gravatar.com
spectrumtop5.xyz
unpkg.com
www.googletagmanager.com
xml.pushking.net
cdn.cookielaw.org
cdn.usefulcontentsites.com
codice.shinystat.com
herbeauty.co
img-cdn.herbeauty.co
jsc.mgid.com
pagead2.googlesyndication.com
s.skimresources.com
secure.gravatar.com
unpkg.com
www.googletagmanager.com
104.19.132.76
104.19.133.76
172.64.152.106
173.214.240.15
199.182.164.180
2606:4700:4400::6812:2b55
2606:4700:4400::ac40:986a
2a00:1450:4001:800::200a
2a00:1450:4001:81d::2003
132cd3518363a09fe20868a435b7f2453fdb2e0f00f6c1bd48c42a27374b6f1f
43f53b38a9bb64d7d391f15fdf98ace93e866a0dc3d92fac093b60dfbacd928b
954c18182661b34804445c033fef8cde055866cec47a41effd7653dfbe367ab3
aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66
cdd0ef5f03074a7ace1942163eb22bb9ffaace3748075ab97bca6bbbc206bc9b
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d78e7ce890aa001f9082e162ce796125ffd49a12b05cd5508c4b790b8d3ec053
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff71185bebfc18fea490956425ee078fb91cb096806897237bee67a1a72546d0

herbeauty.co Open in urlscan Pro 2606:4700:4400::6812:2b55 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

41 Requests

22 %HTTPS

44 %IPv6

17 Domains

23 Subdomains

8 IPs

3 Countries

166 kBTransfer

236 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

41 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

11 Cookies

1 Console Messages

Indicators

herbeauty.co Open in urlscan Pro
2606:4700:4400::6812:2b55 Public Scan

Screenshot
Live screenshot

Full Image

41
Requests

22 %
HTTPS

44 %
IPv6

17
Domains

23
Subdomains

8
IPs

3
Countries

166 kB
Transfer

236 kB
Size

11
Cookies

41 HTTP transactions
0 data transactions