login2.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login2.demonyins.top/
Submission: On May 15 via automatic, source certstream-suspicious (May 15th 2023, 5:42:14 pm UTC) — Scanned from DE

Summary HTTP 133 Redirects Links 80 Behaviour Indicators

Summary

This website contacted 34 IPs in 3 countries across 24 domains to perform 133 HTTP transactions. The main IP is 2606:4700:3031::ac43:d8c7, located in United States and belongs to CLOUDFLARENET, US. The main domain is login2.demonyins.top.
TLS certificate: Issued by GTS CA 1P5 on April 3rd 2023. Valid for: 3 months.

This is the only time login2.demonyins.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3031::ac43:d8c7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
40	151.101.65.164 151.101.65.164	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
5	44.211.112.71 44.211.112.71	14618 (AMAZON-AES) (AMAZON-AES)
2	2600:9000:249... 2600:9000:2491:1600:4:b37b:9440:93a1	16509 (AMAZON-02) (AMAZON-02)
3	52.222.208.154 52.222.208.154	16509 (AMAZON-02) (AMAZON-02)
6	52.222.239.116 52.222.239.116	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
5	2602:803:c003... 2602:803:c003:200::51	26667 (RUBICONPR...) (RUBICONPROJECT)
2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	37.252.171.149 37.252.171.149	29990 (ASN-APPNEX) (ASN-APPNEX)
1	18.196.86.54 18.196.86.54	16509 (AMAZON-02) (AMAZON-02)
1	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
2	143.204.215.97 143.204.215.97	16509 (AMAZON-02) (AMAZON-02)
1 3	13.32.99.105 13.32.99.105	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:6000:18:1fcd:351:7bc1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:20:... 2606:4700:20::ac43:4842	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	54.165.163.91 54.165.163.91	14618 (AMAZON-AES) (AMAZON-AES)
1	20.50.2.28 20.50.2.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2606:4700:20:... 2606:4700:20::681a:7e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
1	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	23.212.88.20 23.212.88.20	16625 (AKAMAI-AS) (AKAMAI-AS)
133	34

10 2606:4700:3031::ac43:d8c7 (United States)

ASN13335 (CLOUDFLARENET, US)

login2.demonyins.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 151.101.65.164 (United States)

ASN54113 (FASTLY, US)

g1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static01.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
samizdat-graphql.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static01.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vp.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 44.211.112.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-211-112-71.compute-1.amazonaws.com

a.et.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2491:1600:4:b37b:9440:93a1 (United States)

ASN16509 (AMAZON-02, US)

rumcdn.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.208.154 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-208-154.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.239.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-239-116.fra56.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2602:803:c003:200::51 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

nytimes-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.149 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.86.54 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-86-54.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.215.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-97.fra53.r.cloudfront.net

dd.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.99.105 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-105.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

5290727.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:6000:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4842 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.165.163.91 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-165-163-91.compute-1.amazonaws.com

pnytimes.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.50.2.28 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

collector.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::681a:7e5 (United States)

ASN13335 (CLOUDFLARENET, US)

platform.iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.212.88.20 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-88-20.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	nyt.com g1.nyt.com — Cisco Umbrella Rank: 9950 static01.nyt.com — Cisco Umbrella Rank: 7579 vp.nyt.com — Cisco Umbrella Rank: 16310 a1.nyt.com — Cisco Umbrella Rank: 8598	2 MB
14	googlesyndication.com 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 143 pagead2.googlesyndication.com — Cisco Umbrella Rank: 107	70 KB
14	nytimes.com samizdat-graphql.nytimes.com — Cisco Umbrella Rank: 6927 a.et.nytimes.com — Cisco Umbrella Rank: 6616 als-svc.nytimes.com Failed www.nytimes.com — Cisco Umbrella Rank: 4493 static01.nytimes.com — Cisco Umbrella Rank: 11070 dd.nytimes.com — Cisco Umbrella Rank: 11192 purr.nytimes.com Failed a.nytimes.com Failed meter-svc.nytimes.com Failed	143 KB
10	demonyins.top login2.demonyins.top	729 KB
9	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 310 aax.amazon-adsystem.com — Cisco Umbrella Rank: 406	63 KB
8	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 205 5290727.fls.doubleclick.net — Cisco Umbrella Rank: 10637	169 KB
6	iteratehq.com platform.iteratehq.com — Cisco Umbrella Rank: 7828 iteratehq.com — Cisco Umbrella Rank: 6848	32 KB
5	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 491	4 KB
3	brandmetrics.com cdn.brandmetrics.com — Cisco Umbrella Rank: 3226 collector.brandmetrics.com — Cisco Umbrella Rank: 3645	18 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 164	847 B
3	google.com adservice.google.com — Cisco Umbrella Rank: 83 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 39	21 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50	2 KB
2	media.net prebid.media.net — Cisco Umbrella Rank: 1430 cs.media.net — Cisco Umbrella Rank: 1560	1 KB
2	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 533 eb2.3lift.com — Cisco Umbrella Rank: 389	725 B
2	openx.net nytimes-d.openx.net — Cisco Umbrella Rank: 13133 u.openx.net — Cisco Umbrella Rank: 683	512 B
2	geoedge.be rumcdn.geoedge.be — Cisco Umbrella Rank: 1720	116 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	154 KB
1	chartbeat.net pnytimes.chartbeat.net — Cisco Umbrella Rank: 7989	201 B
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1680	24 KB
1	gstatic.com fonts.gstatic.com	13 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 192	53 KB
1	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 232	866 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 7680	531 B
133	24

	Domain	Requested by
18	static01.nyt.com	login2.demonyins.top
12	g1.nyt.com	login2.demonyins.top g1.nyt.com 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
10	login2.demonyins.top	login2.demonyins.top rumcdn.geoedge.be
6	tpc.googlesyndication.com	5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com rumcdn.geoedge.be
6	securepubads.g.doubleclick.net	rumcdn.geoedge.be securepubads.g.doubleclick.net 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com www.googletagservices.com
6	aax.amazon-adsystem.com	c.amazon-adsystem.com
5	pagead2.googlesyndication.com	www.googletagservices.com securepubads.g.doubleclick.net tpc.googlesyndication.com
5	fastlane.rubiconproject.com	www.nytimes.com
5	a.et.nytimes.com	login2.demonyins.top
4	iteratehq.com	platform.iteratehq.com
3	sb.scorecardresearch.com	1 redirects login2.demonyins.top
3	static01.nytimes.com	5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
3	5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net rumcdn.geoedge.be 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
3	c.amazon-adsystem.com	login2.demonyins.top c.amazon-adsystem.com
3	samizdat-graphql.nytimes.com	login2.demonyins.top
2	platform.iteratehq.com	login2.demonyins.top platform.iteratehq.com
2	cdn.brandmetrics.com	www.googletagmanager.com rumcdn.geoedge.be
2	a1.nyt.com	login2.demonyins.top www.googletagmanager.com
2	5290727.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	dd.nytimes.com	login2.demonyins.top dd.nytimes.com
2	fonts.googleapis.com	client 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
2	adservice.google.com	rumcdn.geoedge.be 5290727.fls.doubleclick.net
2	rumcdn.geoedge.be	login2.demonyins.top rumcdn.geoedge.be
2	www.googletagmanager.com	login2.demonyins.top www.googletagmanager.com
1	cs.media.net
1	eb2.3lift.com
1	u.openx.net
1	www.google.com	rumcdn.geoedge.be
1	collector.brandmetrics.com	cdn.brandmetrics.com
1	pnytimes.chartbeat.net	login2.demonyins.top
1	static.chartbeat.com	login2.demonyins.top
1	vp.nyt.com	login2.demonyins.top
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googletagservices.com	5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
1	prebid.media.net	www.nytimes.com
1	tlx.3lift.com	www.nytimes.com
1	ib.adnxs.com	www.nytimes.com
1	nytimes-d.openx.net	www.nytimes.com
1	adservice.google.de	rumcdn.geoedge.be
1	www.nytimes.com	login2.demonyins.top
0	meter-svc.nytimes.com Failed	login2.demonyins.top
0	a.nytimes.com Failed	login2.demonyins.top
0	purr.nytimes.com Failed	login2.demonyins.top
0	als-svc.nytimes.com Failed	login2.demonyins.top
133	45

This site contains links to these domains. Also see Links.

Domain
www.nytimes.com
cn.nytimes.com
cooking.nytimes.com
theathletic.com
nytimes.com
help.nytimes.com
www.nytco.com
nytmediakit.com
www.tbrandstudio.com

Subject Issuer	Validity	Valid
*.demonyins.top GTS CA 1P5	`2023-04-03` - `2023-07-02`	3 months	crt.sh
nytimes.com Thawte RSA CA 2018	`2023-03-22` - `2024-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
a.et.nytimes.com R3	`2023-03-17` - `2023-06-15`	3 months	crt.sh
gw.geoedge.be Amazon RSA 2048 M01	`2023-02-21` - `2023-10-10`	8 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
prebid.media.net GTS CA 1D4	`2023-05-09` - `2023-08-07`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
dd.nytimes.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-08` - `2024-04-06`	a year	crt.sh
*.scorecardresearch.com Amazon RSA 2048 M02	`2023-03-01` - `2024-01-28`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2022-05-06` - `2023-06-03`	a year	crt.sh
brandmetrics.com GTS CA 1P5	`2023-05-10` - `2023-08-08`	3 months	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2022-12-19` - `2023-12-30`	a year	crt.sh
*.brandmetrics.com Go Daddy Secure Certificate Authority - G2	`2023-05-10` - `2024-06-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-06` - `2024-05-04`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-18`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://login2.demonyins.top/
Frame ID: 36F40F2541AAE2F39D1E2D2C6C919EF2
Requests: 103 HTTP requests in this frame

Frame: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: A6D67165D9E45B8F7B3A705DA9687F65
Requests: 1 HTTP requests in this frame

Frame: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: E98030714F37940E873A564A2EFD768D
Requests: 19 HTTP requests in this frame

Frame: https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F
Frame ID: 2CD3E486767252D908D88110FDE8A3CE
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: DB4E8010E66DE32123B23C0B54DC0C34
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 7D5720AEF2080A34FD4B02BE541B38EF
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The New York Times - Breaking News, US News, World News and VideosGroupGroupGroup

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Datadome (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

133
Requests

94 %
HTTPS

55 %
IPv6

24
Domains

45
Subdomains

34
IPs

3
Countries

3598 kB
Transfer

7822 kB
Size

18
Cookies

80 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nytimes.com/es/
Title: Español

Search URL Search Domain Scan URL

URL: https://cn.nytimes.com/
Title: 中文

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/todayspaper
Title: Today’s Paper

Search URL Search Domain Scan URL

URL: https://cooking.nytimes.com/
Title: Cooking

Search URL Search Domain Scan URL

URL: https://theathletic.com/
Title: The Athletic

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/wirecutter/
Title: Wirecutter

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/crosswords
Title: Games

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/upshot/migrations-college-super-cities.html
Title: College-Educated Workers Are Leaving Coastal Cities, Analysis ShowsThe college graduates who fill white-collar jobs are migrating away from the country’s most expensive major metros — and have been since before the pandemic.10 min read<img src="https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoMediumAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-polls-erdogan.html
Title: Analysis: Erdogan’s Grip on Power Is Loosened but Not Broken, Vote ShowsDespite a struggling economy and the opposition to Turkey’s drift toward one-man rule, President Recep Tayyip Erdogan was leading ahead of a presidential runoff.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-results-erdogan-runoff.html
Title: Here are four takeaways from Turkey’s nail-biting presidential election.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/world/europe/turkey-election-results.html
Title: These maps show how every province in Turkey has voted so far.

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2023/05/15/world/russia-ukraine-news
Title: Britain Promises More Missiles and Drones on Zelensky’s VisitA brief stop in England by President Volodymyr Zelensky of Ukraine on Monday came after a whirlwind trip through Europe’s capitals over the weekend.See more headlines 8+

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/business/economy/russia-airlines-sanctions-ukraine.html
Title: Russian customs data showed that millions of dollars of U.S.-made aircraft parts were sent to Russia last year.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/europe/wagner-prigozhin-bakhmut.html
Title: The Wagner leader disputed a report that he offered to betray Russia.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/science/environmental-dna-ethics-privacy.html
Title: Your DNA Can Now Be Pulled From Thin Air. Privacy Experts Are Worried.Environmental DNA research has aided conservation, but scientists say its ability to glean information about human populations and individuals poses dangers.8 min read<img src="https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An artist’s illustration depicting a blue and black vortex pulling DNA helixes from a pond in a park surrounded by trees and skyscrapers." class="css-122y91a"/>Isabel Seliger

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/business/diversity-equity-inclusion-belonging.html
Title: Why Some Companies Are Opting to Use the Term ‘Diversity and Belonging’The changing terminology reflects new thinking among some consultants, who say traditional D.E.I. strategies haven’t worked out as planned.7 min read<img src="https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Karith Foster, the chief executive of Inversity Solutions, wears an eggplant-colored dress and waves one hand in the air as she speaks to an audience." class="css-122y91a"/>Karith Foster, chief executive of the consultancy Inversity Solutions, said an overemphasis on identity groups and a tendency to reduce people to “victim or villain” can alienate. Nick Oxford for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/nyregion/brooklyn-seltzer-boys.html
Title: Inside the Last Old-School Seltzer Shop in New YorkBrooklyn Seltzer Boys has a century-old carbonator and a museum with a spritzing station. Beat that, LaCroix.Juan Arredondo for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/north-carolina-abortion-veto-roy-cooper.html
Title: Abortion Showdown in North Carolina May Hinge on a Single VoteAfter the G.O.P.-led legislature passed a 12-week ban, the Democratic governor vetoed the bill. The Republicans could override it, if they stay unified.6 min read<img src="https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A man in a white dress shirt and light blue tie speaks at a podium. " class="css-122y91a"/>Roy Cooper, the Democratic governor of North Carolina, vetoed a bill banning abortion at 12 weeks. Kate Medley for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/nyregion/nyc-garage-collapse.html
Title: A Crumbling New York Garage Collapsed. Dozens More Have Similar Problems.The fatal failure of a building in Manhattan raised questions about parking structures across the city. Records and interviews revealed widespread issues.10 min read<img src="https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Fallen bricks cover a car at a collapsed garage on Ann Street." class="css-122y91a"/>Dave Sanders for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/technology/eu-microsoft-activision-blizzard.html
Title: E.U. Approves Microsoft’s $69 Billion Deal for ActivisionThe green light follows objections to the blockbuster deal by American and British regulators on the grounds that it would undercut competition.4 min read<img src="https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Men wearing headphones are seated at a long table in front of computer screens in a dark room with purple, pink and green neon lights. " class="css-122y91a"/>Sergio Flores/Bloomberg

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-alan-ruck.html
Title: Alan Ruck Is Ready to Leave the Roy FamilyAs “Succession” nears its end, the veteran actor is looking forward to closing the book on Connor Roy.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/arts/television/succession-recap-season-4-episode-8.html
Title: “Succession” recap: It’s election night in America. Stay away from the bodega sushi.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-election.html
Title: Democracy went up for sale in “Succession.” In the real world, the price is usually cheaper, our critic writes.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/friars-club-last-call.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman walks past a stone townhouse whose first floor features purple canopies." class="css-122y91a"/>Hiroko Masuike/The New York TimesIs It Last Call at New York’s Friars Club?The headquarters of the legendary entertainment fraternity is facing the threat of foreclosure as its leaders look for a buyer to help keep the party going.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/sports/tennis/pickleball-platform-tennis-padel.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An overhead shot of a large outdoor facility with multiple blue courts. A palm-tree-lined road can be seen in the distance." class="css-122y91a"/>Are you on team tennis, pickleball or padel? Or all three?6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/12/science/demon-shark-new-species-australia.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Apristurus ovicorrugatus, a long, gray shark with bright white eyes." class="css-122y91a"/>There’s something “spooky” about this newly discovered shark species.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/opinion
Title: Opinion

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/trump-cnn-biden-jordan-neely.html
Title: Gail Collins and Bret StephensTrump Cannot Be Unseen7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/youth-achievement-happiness.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A photograph of a young pianist’s hand on a keyboard." class="css-122y91a"/>Adam GopnikWhat We Lose When We Push Our Kids to ‘Achieve’6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/france-macron-le-pen.html
Title: Mitchell Abidor and Miguel LagoHow Marine Le Pen Became France’s Voice of Reason5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/chips-incentives-biden.html
Title: Nathan M. Jensen and Steven PedigoWhy Laws Meant to Create Jobs Can Be So Destructive for Our Cities5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letter-to-graduates-hope-despair.html
Title: <img src="https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Margaret Renkl" class="css-122y91a"/>Margaret RenklGraduates, My Generation Wrecked So Much That’s Precious. How Can I Offer You Advice?5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/title-42-border-immigration.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A child looking through the gap in a rusty corrugated metal wall." class="css-122y91a"/>Karla Cornejo VillavicencioImmigrants Love America the Way It Needs to Be Loved4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letters/ralph-nader-third-parties.html
Title: Letters From Our ReadersRalph Nader and Others Clash Over the Value of Third Parties5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/jordan-neely-killing-subway.html
Title: <img src="https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="David French" class="css-122y91a"/>David FrenchWhen the Rule of Law Fails Us5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/sudan-medicine-doctors.html
Title: Farah StockmanLeaders Stay, Others Run5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/mothers-day-stepmother.html
Title: Rachel Louise SnyderWhat Do You Say When the Person You Love Most in the World Returns?7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/debt-limit-constitution.html
Title: Michael W. McConnellThe Case for Violating the Debt Limit Is Dangerous Nonsense4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/digital-screen-time-children.html
Title: Tish Harrison WarrenManaging Screen Time Is a Family Matter7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/11/opinion/pandemic-learning-losses-steep-but-not-permanent.html
Title: Tom Kane and Sean ReardonParents Don’t Understand How Far Behind Their Kids Are in School

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/frankenheimer-seconds-movie.html
Title: Jamelle BouieJohn Frankenheimer Pointed His Camera Toward the Things We Cannot Escape6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-town-hall-cnn.html
Title: Maureen DowdAs Sun Tzu Says, ‘Know the Enemy’4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-cnn-tv-news.html
Title: Bill SammonWe’re Asking the Wrong Questions About the Trump Town Hall4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/podcasts/the-daily/banning-spywear.html
Title: Listen to ‘The Daily’Inside the U.S. government’s double-edged relationship with the most powerful and notorious hacking tool.<img src="https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/briefing/the-case-for-journalistic-independence-ag-sulzberger.html
Title: Read The MorningCovid coverage offers a case study of journalistic independence, David Leonhardt writes.7 min read<img src="https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/us/migrants-condition-title-42-ends.html
Title: After a Border Policy Ends, the Migration Surge Abates. For Now.Economic hardship, climate change, political instability and gang violence will continue to spur emigration to the U.S. from many corners of the world.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/health/alzheimers-mutation-gene.html
Title: Mutation Protected Man From Alzheimer’s Disease, Hinting at TreatmentA man in his early 40s showed physical signs of the illness, but didn’t develop symptoms until he was nearly 70 because of a protective gene.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/politics/biden-monica-bertagnolli-nih.html
Title: A Cancer Surgeon and Patient Is Biden’s Pick to Lead N.I.H.President Biden said that he had selected Dr. Monica Bertagnolli to be the next director of the National Institutes of Health.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/chicago-mayor-brandon-johnson-policing-migrants.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15nat-chicago-new-mayor-promo-ljcz/15nat-chicago-new-mayor-promo-ljcz-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>Jamie Kelter Davis for The New York TimesWhat Chicago’s New Mayor Says About the City’s Biggest ChallengesBrandon Johnson, a progressive Democrat who was sworn in today, explains how he plans to manage the nation’s third-largest city in a complicated moment.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/style/spring-fashion-street-style.html
Title: <img src="https://static01.nyt.com/images/2023/05/14/multimedia/16STYLE-OUTSIDE-SPRING-02-zkwm/16STYLE-OUTSIDE-SPRING-02-zkwm-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman, seen from the hips up, standing on a street. She has dark curly hair that falls below her shoulders and is wearing a pink cross-body bag, a green bomber jacket, a blue, green and orange striped sweater and a chain necklace. " class="css-122y91a"/>Spring Dressing Isn’t ImpossibleThe key? Don’t worry about following rules.1 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/style/wardrobe-update-color.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12openThread-QA-fjhm/12openThread-QA-fjhm-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Cruz Beckham, wearing sunglasses and a bright yellow and royal purple jacket; Jaden Smith, in head-to-toe camouflage print; and Justin Timberlake, wearing a Kenzo jacket the color of a martini olive, sitting in the front row of a fashion show." class="css-122y91a"/>How Do I Upgrade My Carhartt Wardrobe?A reader wants to spruce up a closet full of “drab Pacific Northwest earth tones.”3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/business/ana-ros-michelin-woman-chef.html
Title: <img src="https://static01.nyt.com/images/2023/04/27/multimedia/00Transforming-Chef-vkjl/00Transforming-Chef-vkjl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman in a white chef’s outfit leans on a large wooden table with her hand on her chin. Next to her on the table is a tall plant in a pot. In the background are framed paintings on the wall. " class="css-122y91a"/>Ana Ros, One of the World’s Best ChefsShe broke through the boys’ club of fine dining, earning two Michelin stars.7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/anne-berest-the-postcard.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11Berest-01-hfqg/11Berest-01-hfqg-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="The author Anne Berest is seen in profile, in a white button-down shirt. " class="css-122y91a"/>A Mysterious Postcard Sparks a NovelAnne Berest’s “The Postcard” is part Holocaust drama, part family mystery.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/review/henry-threadgill-easily-slip-into-another-world.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15threadgill-review-wzbl/15threadgill-review-wzbl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A black-and-white photograph of Henry Threadgill playing the saxophone." class="css-122y91a"/>Vietnam Changed How He Heard the WorldHenry Threadgill’s memoir traces his wartime experience to his jazz career.5 min read

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519232/2023/05/15/ja-morant-gun-instagram-live-punishment/
Title: All Ja Morant Had to Do Was Learn From His Suspension. He Didn’t. Now What?After another gun-related incident, the N.B.A. star’s luck has almost certainly run out, our columnist writes.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519445/2023/05/15/dodgers-padres-nl-west-standard/
Title: Why the Dodgers, Not the Padres, Remain the StandardUntil proven otherwise, there is a separator between these two teams: One knows how to win.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519924/2023/05/15/sixers-celtics-game-7-playoffs-uncertainty/
Title: This Year Might Have Been the 76ers’ Best Chance at a Title. They Blew It.Nobody took a greater individual hit with their Game 7 performance than Joel Embiid.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4509806/2023/05/15/fourth-official-premier-league-hell/
Title: The Worst Job in Soccer: ‘It’s 90 Minutes of Hell’

Search URL Search Domain Scan URL

URL: https://theathletic.com/4474815/2023/05/15/florida-football/
Title: College Football Is in an Arms Race. One Storied Program Is Falling Behind.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4520492/2023/05/15/manchester-city-premier-league-title/
Title: Could Premier League Punishments Affect the Title Race?

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/games/wordle/index.html
Title: WordleGuess the 5-letter word with 6 chances.<img src="https://static01.nyt.com/images/2022/03/02/crosswords/alpha-wordle-icon-new/alpha-wordle-icon-new-square320-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/crosswords/wordle-review-answer-694.html
Title: Today’s Wordle ReviewOur columnist reviews the day’s puzzle. Warning: Contains spoilers!2 min read<img src="https://static01.nyt.com/images/2023/05/14/crosswords/14wordle-review-art/14wordle-review-art-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="On a muted red background in painterly strokes, three langurs ranging in tone from teal to green run and jump alongside a b-boy dancer wearing a bright magenta hoodie and army green pants. The day's Wordle number is layered on top." class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://nytimes.com/games/digits
Title: Digits | BetaChallenge yourself with a daily numbers puzzle.<img src="https://static01.nyt.com/images/2023/03/21/crosswords/alpha-digits-icon-beta/alpha-digits-icon-beta-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/spelling-bee
Title: Spelling BeeHow many words can you make with 7 letters?<img src="https://static01.nyt.com/images/2019/04/18/homepage/spelling-bee-logo-bulletin/spelling-bee-logo-bulletin-square320-v5.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/letter-boxed
Title: Letter BoxedCreate words using letters around the square.<img src="https://static01.nyt.com/images/2021/05/27/multimedia/alpha-letterboxed-promo-1622145789727/alpha-letterboxed-promo-1622145789727-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014792127-Copyright-notice
Title: © 2023 The New York Times Company

Search URL Search Domain Scan URL

URL: https://www.nytco.com/
Title: NYTCo

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015385887-Contact-Us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015727108-Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.nytco.com/careers/
Title: Work with us

Search URL Search Domain Scan URL

URL: https://nytmediakit.com/
Title: Advertise

Search URL Search Domain Scan URL

URL: https://www.tbrandstudio.com/
Title: T Brand Studio

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/cookie-policy#how-do-i-manage-trackers
Title: Your Ad Choices

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893428-Terms-of-service
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893968-Terms-of-sale
Title: Terms of Sale

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/ca/?action=click&region=Footer&pgtype=Homepage
Title: Canada

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/international/?action=click&region=Footer&pgtype=Homepage
Title: International

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us
Title: Help

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/subscription?campaignId=37WXW
Title: Subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 102

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F HTTP 302
https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F

Request Chain 117

https://sb.scorecardresearch.com/c2/3005403/cs.js HTTP 302
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

133 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login2.demonyins.top/ 538 KB
96 KB 1197ms
507ms Document
text/html 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f514b08fb7d5209344628ea9664fd4d59a79c6060c0f8be77ac68e85a9d5ceec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 18
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: s-maxage=30,no-cache
cf-cache-status: DYNAMIC
cf-ray: 7c7d2ce66ace30db-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 17:42:05 GMT
last-modified: Mon, 15 May 2023 17:41:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sciOQJkL%2FvoPg14AM6tHzlEn49JgnQz7e%2BQGJNbTntpHFKRFF1ymgyYMEET%2Fkgy%2FwrWf81CofEcufTemEG8TBGBMUYGS15Nek6Tw3BrCvSn1sCGEOMB%2Br0KXe%2Fb95LJgwPwhKDohf4e2fzp8T89VaaACiA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; preload; includeSubdomains
vary: Accept-Encoding, Fastly-SSL
x-api-version: F-F-VI
x-b3-traceid: 8575bac6ca8b4ad7be913158835db50d
x-cache: HIT, HIT
x-cache-hits: 4, 1
x-cloud-trace-context: 3a6cbfce90ed50efb9e2ec567c9f3c05/2117049989809387257;o=1
x-content-type-options: nosniff
x-frame-options: DENY
x-gdpr: 0
x-nyt-app-webview: 0
x-nyt-data-last-modified: Mon, 15 May 2023 17:41:43 GMT
x-nyt-edge-cache: HIT-HIT
x-nyt-route: homepage
x-origin-time: 2023-05-15 17:41:47 UTC
x-pagetype: vi-homepage
x-served-by: cache-lga21923-LGA, cache-sna10731-LGB
x-timer: S1684172525.954752,VS0,VE5
x-xss-protection: 1; mode=block

GET
H2 200 web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
g1.nyt.com/fonts/css/ 60 KB
10 KB 644ms
210ms Stylesheet
text/css 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 08 May 2024 06:56:45 GMT
date: Mon, 15 May 2023 17:42:05 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 557121
x-guploader-uploadid: ADPycdt4rzBKSPk3PxNrGBU5jXfNHaFAvmvMXMwYJFE6yLOJ8WdvcckM5xebSb96YkjgxWF6Naez2Y0KZfzziO0XIcWalw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 9868
x-served-by: cache-gig2250055-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.595856,VS0,VE0
etag: "b79308aee772cf8921761a4fdb884fe5"
vary: Accept-Encoding
x-goog-generation: 1673991774978541
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=ay5bmg==, md5=t5MIrudyz4khdhpP24hP5Q==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 9868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 5297

GET
H2 200 global-f449cfd9976ad673ef2b7ab5098b85be.css
login2.demonyins.top/vi-assets/static-assets/ 6 KB
3 KB 500ms
500ms Stylesheet
text/css 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsIkqZ227oSkhi_DuQFG3K-bLhwXa1gCU8NN5dnwn05jZE56FGlKAHTE3mGwjBW8GspHPN_ZTL3sWhFI_lboEiuTA
x-goog-stored-content-encoding: identity
x-origin-time: 2022-10-12 15:49:59 UTC
x-served-by: cache-sna10751-LGB
x-timer: S1684172525.475760,VS0,VE1
etag: W/"e74f8b7c668251280cf3e52e20455a1c"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1665589250507895
content-type: text/css; charset=utf-8
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 47066
expires: Thu, 12 Oct 2023 15:49:59 GMT
date: Mon, 15 May 2023 17:42:05 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 12 Oct 2022 15:40:50 GMT
server: cloudflare
x-goog-hash: crc32c=jAKqfw==, md5=50+LfGaCUSgM8+UuIEVaHA==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y16xHomepklF88dXn4rLu6l0UaSfJnhDMIf6zmUDVpQ%2F1v60upX2zmQLP18G4py%2By81gW2%2Ba0%2FjItgpAaJ2UiOzIPIfnEbsT%2F5AWPfkUd2z%2B7WulV4cJKeLoUpqrpDqFPBYdye5i0bKBkV0J1Kjdx011Ow%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 5656
cf-ray: 7c7d2ce99ff030db-FRA

GET
H3 200 adslot-6cfc3a3f6d8b97c7ed5d.js Show response
login2.demonyins.top/vi-assets/static-assets/ 22 KB
9 KB 508ms
508ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtFud2DScbQxsNseMq9LLPLoKbKs64XIgl0nTVYW-ZPFHcRI4W4fdZ38lT77yRtlZ3FHNL2hsOlw-FTL0L86gvmdA
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-09 16:20:10 UTC
x-served-by: cache-sna10749-LGB
x-timer: S1684172526.969049,VS0,VE2
etag: W/"de5aa7ec9e5831fb28f94291b754ad06"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683591394785641
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 15711
expires: Wed, 08 May 2024 16:20:10 GMT
date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 09 May 2023 00:16:34 GMT
server: cloudflare
x-goog-hash: crc32c=/TEQzw==, md5=3lqn7J5YMfso+UKRt1StBg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sUjSeyypAGGiNJg27%2FawlJnorwTzvoNQFDn2gmpJ9pZwLyexXLr%2BEm17ccCBCWCMG%2F0Fzx2i%2FtvoFSoiDUO33s6f9Eg4f0T37eoADxqKeoIwhGZ0R8AE9B3z29jMGQ%2FNDF5aIbrbo7hnDt7NA44RQEdRLw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 22455
cf-ray: 7c7d2cecbaca39ce-FRA

GET
H2 200 migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png
static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/ 5 KB
6 KB 210ms
210ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:56:21 GMT
date: Mon, 15 May 2023 17:42:05 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2744
x-guploader-uploadid: ADPycds1vaZaGuRRwVI19p1s5hZifhadsL2b4xdTVxou7JPtabON2MDUjKNW3Olg6F6Cb7NX-0VtSbOcZoI2kfGeqlo7sfvqL1Ww
x-cache: HIT, HIT
fastly-io-info: ifsz=6963 idim=600x400 ifmt=png ofsz=5138 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5138
x-served-by: cache-iad-kiad7000107-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172526.827483,VS0,VE0
etag: "oAAnPmik7S+cpW4zkJny51Y3vnT+7aHzXrSDICAzEx8"
vary: Accept
x-goog-generation: 1684169781405530
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=HuZetw==, md5=5dZsBOhm7OlCQJwcs2yW2w==
cache-control: public, max-age=604800, stale-if-error=86400, stale-while-revalidate=30
x-goog-stored-content-length: 6963
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 24, 25

GET
H2 200 15friars-01-zvpb-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/ 27 KB
28 KB 211ms
209ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 14:03:25 GMT
date: Mon, 15 May 2023 17:42:05 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 13120
x-guploader-uploadid: ADPycdsKdhkyGaVXNlPx8_TWP_gklpqRtITwKCnC_8_KdTPqNK2RWn46qBUqzATia733SQxeUDzPo4vBLG4-rthRHC-41g
x-cache: HIT, HIT
fastly-io-info: ifsz=58196 idim=600x400 ifmt=jpeg ofsz=28020 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 28020
x-served-by: cache-iad-kiad7000088-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172526.843507,VS0,VE0
etag: "zLSutaEg7LOPioqy12EcF2ZuADfKRVR/MV4cP4UuFb4"
vary: Accept
x-goog-generation: 1684159208058553
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=vXe1Qg==, md5=sna7XdICa0MV3yzBcN3/SA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 58196
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 22, 31

GET
H2 200 11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/ 68 KB
69 KB 414ms
412ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 11 May 2023 14:02:48 GMT
date: Mon, 15 May 2023 17:42:05 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 358757
x-guploader-uploadid: ADPycds3IJiaxkBzqJ5VTcjfQTGianmgPdkgTCvSGu8d907FNYdMHYf2LX5EZ5SDK6WGkcaEiao-1zZo53zTdQtcjH07HA
x-cache: HIT, HIT
fastly-io-info: ifsz=126323 idim=600x400 ifmt=jpeg ofsz=69842 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69842
x-served-by: cache-iad-kjyo7100082-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172526.844373,VS0,VE0
etag: "HpOrjgklDZPyIY+tBN++vannKxDEhastw8795X2ynto"
vary: Accept
x-goog-generation: 1683813610590802
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=h72b8w==, md5=zIXwAVlosHSMTh/cMiKBCA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 126323
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 21, 50

GET
H2 200 12xp-shark-01-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/ 9 KB
9 KB 287ms
285ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Fri, 12 May 2023 10:37:59 GMT
date: Mon, 15 May 2023 17:42:05 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 284646
x-guploader-uploadid: ADPycdvmG54jO3g7BrAh6piCQ5vgP3ipBqbl-lRZXgCptDizkELuhSXttN5gu7_28Y8JNsJMY88PTaz8elohZ5eHiEAMBg
x-cache: HIT, HIT
fastly-io-info: ifsz=31223 idim=600x401 ifmt=jpeg ofsz=8948 odim=600x401 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 8948
x-served-by: cache-iad-kcgs7200083-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172526.844328,VS0,VE0
etag: "zb5NLricPNuu23pF3Ka0EAFlQaleZgG3MNFZHiN2h0Y"
vary: Accept
x-goog-generation: 1683887404987381
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=+Vy6Cw==, md5=bEE6TPSYv/aoTAYTe/3LiQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31223
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 12, 54

GET
H3 200 vendor-b261f5b50fd0c857de07.js Show response
login2.demonyins.top/vi-assets/static-assets/ 173 KB
50 KB 726ms
725ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvvM3qJhPs3K9OO8vMI9HU0GiqfZNkdQ-YYPpgeGmLxJJzjZEBRgMiHDr-MtGtJaDgbI_CMgX-uOm7hKVe-XFptauX8Z11-
x-goog-stored-content-encoding: identity
x-origin-time: 2023-03-28 18:40:27 UTC
x-served-by: cache-sna10737-LGB
x-timer: S1684172526.169842,VS0,VE1
etag: W/"0e1f964af1f8b128478e4eda19557589"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680028418821973
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 13706
expires: Wed, 27 Mar 2024 18:39:41 GMT
date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Mar 2023 18:33:38 GMT
server: cloudflare
x-goog-hash: crc32c=RBkcUw==, md5=Dh+WSvH4sShHjk7aGVV1iQ==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mAhi76jxAuiPrvNh1ohd9WUCGX9Z9xnFhE4umWL%2B9zdMWy%2Bny4NeQpkMwKAPjUX24nR06Pu9Ue7sKCEN5SFokiR4sohfFlFSjAEo4jdaDWObeVCUXJqBQmqc%2F7jRoh8DeXOcWPYqIn0%2BPgl0dLojD9e9Ug%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 177285
cf-ray: 7c7d2ceddcb639ce-FRA

GET
H3 200 home-eec6ea674dcf0eaf7d99.js Show response
login2.demonyins.top/vi-assets/static-assets/ 126 KB
38 KB 745ms
744ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsUixxI06ubQPi5neC8O39XDYiTrVwmut96QQOBerZ6-h04cKvKdZZ30d3VJYUyZFi8pgbwChna4Rd_vDV4hlwDk0a8Ewd0
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:12 UTC
x-served-by: cache-sna10731-LGB
x-timer: S1684172526.175061,VS0,VE1
etag: W/"0a29421703521881f558d8447f92a666"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164958533057
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 354
expires: Tue, 14 May 2024 15:36:12 GMT
date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:58 GMT
server: cloudflare
x-goog-hash: crc32c=Ct1gRw==, md5=CilCFwNSGIH1WNhEf5KmZg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2xD7a6K7acIiquVEsoq%2F9%2B7JXEBQ4%2FOMHWVsTjwlirOQNAnmEkdUVDGULd4jDPp5Dn%2BZTWVK3c858YgMOSSyZA6cHrsPaMndGno7l%2BSbtSsiw529Aa7JL8Olxk3ht9xfrod0fhalztMZqybDnkqOP%2BM4Yw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 129273
cf-ray: 7c7d2ceddcb839ce-FRA

GET
H3 200 main-1ad4ce4767d07fda924f.js Show response
login2.demonyins.top/vi-assets/static-assets/ 1 MB
397 KB 713ms
711ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycds7Y0JFQ3SYUirErJM8-bSP0FQLnaJIyi8kW1DkeGopdkvKdUX4QLPpER_OjlA-Ufbld2CokzZarSpVbF3VMhq13w
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:05 UTC
x-served-by: cache-sna10730-LGB
x-timer: S1684172526.152789,VS0,VE1
etag: W/"e6a18ada99f396749121cb58a7b0480a"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164901170648
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 507
expires: Tue, 14 May 2024 15:36:05 GMT
date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:01 GMT
server: cloudflare
x-goog-hash: crc32c=KPr/9g==, md5=5qGK2pnzlnSRIctYp7BICg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z3nKstq80eHYjBBfiWXCHvhnHzMym%2FQ4UfZEt%2Fgcox6NiHEcYiTTpRroKGMlkxZqpdLlyZ3SQrTSP%2B3E%2BUhEu0tA3ycT1RXuzEGpQbLOQNjSZhKot9zFvzS7l4MOUGtub6v5iv3uyGXt9Avky3d9ZHMyPg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 1454644
cf-ray: 7c7d2ceddcbb39ce-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 406 KB
110 KB 44ms
20ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a3bfb92d43190843562798ecf3be33e1c0681aba24625e7357a27a588ae09d8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112463
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
vary: *
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 787ms
357ms Preflight 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login2.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 0
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:42:06 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 16
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: MISS
x-nyt-meridiem: PM
x-nyt-region: HE
x-samizdat-query-exe-id: a5da082541acda6d
x-samizdat-query-field-errors: 0
x-served-by: cache-gig2250076-GIG
x-timer: S1684172526.269415,VS0,VE144

POST
H2 200 track
a.et.nytimes.com/ 0
0 331ms
125ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET als
als-svc.nytimes.com/ 0
0

GET
H2 200 grumi-ip.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 14 KB
6 KB 22ms
6ms Script
application/javascript 2600:9000:2491:1600:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:1600:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:35 GMT
x-amz-version-id: ZeZbQXIiZ8B7xRijiw8G.q9OnSDyuFAm
content-encoding: br
last-modified: Mon, 27 Mar 2023 06:19:38 GMT
server: AmazonS3
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
etag: W/"22b4da07003fc88ea067e3f866ea9c5a"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=14400, stale-while-revalidate=14400, immutable
age: 991
x-amz-cf-id: _evaSJKKXgJntt6_MJU5vZHuF0kaP4D2sbHavxdlzcIVNV9ntadDuA==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 230 KB
57 KB 31ms
8ms Script
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 16:49:17 GMT
content-encoding: gzip
via: 1.1 0c8bf5614b4bcc3e76982cb7ff9a7662.cloudfront.net (CloudFront), 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
last-modified: Wed, 10 May 2023 21:23:06 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1, FRA56-P3
age: 3169
x-amz-server-side-encryption: AES256
etag: W/"e6af4658ab1a6fdde1f0066b27d5372e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: mWnGkBqeiZN0UFDk7CrA5H6JBvee5bALTSOrvm5TgosbarSCwrFZkA==

GET
H2 200 prebid7.43.0b.js Show response
www.nytimes.com/ads/ 248 KB
80 KB 448ms
439ms Script
text/javascript 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nytimes.com/ads/prebid7.43.0b.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418

Security Headers

Name

Value

Content-Security-Policy

upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;

Strict-Transport-Security

max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: gzip
age: 545337
x-guploader-uploadid: ADPycdvbu1hO-swHczzZJRW8dEGIoRjz-_OYoRuXVsgDhr3ZUoZnFUlBvZ2Jb9YArzgOinyaQDMC9gdPDnuOGDIVvMuSGuT3_LHy
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-18 06:56:33 UTC
x-served-by: cache-gig2250055-GIG
x-timer: S1684172526.852063,VS0,VE1
etag: "b1c0bb337eb2ca2772e3f66ea859162e"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680615397749795
content-type: text/javascript
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/ads/prebid7.43.0b.js
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-nyt-app-webview: 0
x-nyt-route: ads-static-assets
x-nyt-edge-cache: HIT
x-cache-hits: 6930
expires: Tue, 18 Apr 2023 06:56:33 GMT
date: Mon, 15 May 2023 17:42:05 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
content-length: 80465
last-modified: Tue, 04 Apr 2023 13:36:37 GMT
server: UploadServer
x-goog-hash: crc32c=J7VdOQ==, md5=scC7M36yyidy4/ZuqFkWLg==
x-gdpr: 1
x-goog-stored-content-length: 253681
accept-ranges: bytes

GET
DATA 200
OK truncated
/ 148 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e

Request headers

Referer
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2
g1.nyt.com/fonts/family/franklin/ 20 KB
20 KB 645ms
215ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 18 Apr 2024 05:49:02 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2289183
x-guploader-uploadid: ADPycdtkjsd0UbJjL180ZqP7_8R_QnIJqEbuNFxiGwXc_4E5_3rloY6qZpmztk6GwcXJtY_r6ozsT4x8CNA1zdVBc8H5rN8rKdvn
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 20276
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172526.299388,VS0,VE0
etag: "91eaf6b5642463af4091160b4bbfdfcb"
x-goog-generation: 1673991776265363
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=teZvhg==, md5=ker2tWQkY69AkRYLS7/fyw==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 20276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 5010

GET
H2 200 franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2
g1.nyt.com/fonts/family/franklin/ 19 KB
20 KB 645ms
214ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 01 May 2024 06:05:01 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1165025
x-guploader-uploadid: ADPycduXmeJC__9NKf5kucuqhe-_eyqgiGXspXsodYckYFkYRy_Vjlt3sQ_3QM5FHLb3ycvGuoxGuCgduRiTowlGo80vew
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 19816
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172526.299740,VS0,VE0
etag: "0f4aea3d462cdb64748629efcbbf36bc"
x-goog-generation: 1673991776231570
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=bdL0Mw==, md5=D0rqPUYs22R0hinvy782vA==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 19816
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 5056

GET
H2 200 cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2
g1.nyt.com/fonts/family/cheltenham/ 28 KB
28 KB 861ms
432ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 24 Apr 2024 06:18:16 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1769030
x-guploader-uploadid: ADPycdvxB6htpcHUVBscudQCtPo10SRWChArMtfLriyqgSEXh6Yns_vdLJuI1PlKJkeTBpnwaHmxyK_94trVgxWwddxrdQ
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28276
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.300045,VS0,VE0
etag: "530cfb72378419eedb60da7e266ad5f1"
x-goog-generation: 1673991775200429
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=O9qQIA==, md5=Uwz7cjeEGe7bYNp+JmrV8Q==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 403

GET
H2 200 imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2
g1.nyt.com/fonts/family/imperial/ 26 KB
26 KB 644ms
215ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/imperial/imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 24 Apr 2024 06:18:16 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1769030
x-guploader-uploadid: ADPycdtSkfbuQFoTPCyqt1h7VB9SJGyMQ0GBJOLzrvI2H3v-jPfpINIk5tlidc-hMGgavuFmtQwCTTHLETMVo9aOK_kGdJ6x7wr_
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26504
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172526.299434,VS0,VE0
etag: "6131cd77b6e216c7693ed925f4309ffc"
x-goog-generation: 1673991776736810
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=ZzOuxA==, md5=YTHNd7biFsdpPtkl9DCf/A==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26504
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 4932

GET
H2 200 cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2
g1.nyt.com/fonts/family/cheltenham/ 27 KB
27 KB 862ms
433ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 25 Apr 2024 07:58:56 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1676590
x-guploader-uploadid: ADPycdtOP1N-D3guNC0Dbta0FihSzAh774B-Uz5iPhRCvlZQ9Ht_SxHBAqrV-lNSSBVg4F1s-7L-LaKfoLUeSfxcdGxM4Q
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 27260
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.300976,VS0,VE0
etag: "7ea91ebd036309e1fe756ee3aab272da"
x-goog-generation: 1673991775007595
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=rNQ9pA==, md5=fqkevQNjCeH+dW7jqrJy2g==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 27260
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 962

GET
H2 200 cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
24 KB 861ms
432ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 01 May 2024 09:14:01 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1153685
x-guploader-uploadid: ADPycdusdk2CmXdT3D6Ll8URnW_ndRaaBWoL27nd9anSIwtih_aJZnv098rkddTYO1v12j3JH6T90IVVfHiSPcUClYuOGw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 23704
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.300392,VS0,VE0
etag: "1a0b316424cdebd18086b8dbbc768eef"
x-goog-generation: 1673991775396405
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=FTq84Q==, md5=GgsxZCTN69GAhrjbvHaO7w==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 23704
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 6

GET
H2 200 cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2
g1.nyt.com/fonts/family/cheltenham-text-cond/ 28 KB
28 KB 862ms
433ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-text-cond/cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 17 Apr 2024 06:50:05 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2371921
x-guploader-uploadid: ADPycdsNzxy8dgO7dB_m9FmhIBqTV0Me31OzS7YN2AV7S5pNUMCW6yXsop4xkWuxyw53iIU5wxvYKOl9kaARlG-vkG2lKTQyFq07
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28868
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.300885,VS0,VE0
etag: "7e78f9e7e6c2e02d82592c4466929fa3"
x-goog-generation: 1673991775506403
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=UQFt6w==, md5=fnj55+bC4C2CWSxEZpKfow==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 123

GET
H2 200 cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
24 KB 873ms
444ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 17 Apr 2024 10:12:04 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2359801
x-guploader-uploadid: ADPycdvY3BGNsccsQDhnl2edPsZG9aMQ1E6cv-qhxVWeSyxG2uf3METOZPPL0l9dGIOTFyQDZB_umIHG7A4CDeIu0UXHpA0_t-Ih
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 24028
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172527.511735,VS0,VE0
etag: "cdfa0ec29cca8c2d2f54c79d898e15c1"
x-goog-generation: 1673991775386814
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=2JQyuQ==, md5=zfoOwpzKjC0vVMediY4VwQ==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 24028
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2
g1.nyt.com/fonts/family/cheltenham/ 26 KB
26 KB 860ms
432ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login2.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 18 Apr 2024 05:46:42 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2289323
x-guploader-uploadid: ADPycdtHeU8lxk6ZrmKO5CVjmWwpq3mX5l95291Gnpx9gUoDr0d3FoOHRrwRhyWZXC1aIDITu3x98L2JwrJ1SY_WJznWZr7CzBN8
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26448
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172526.300596,VS0,VE0
etag: "40ccfe2cc61a71e6617e56162d49b896"
x-goog-generation: 1673991775015704
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=kUZRqw==, md5=QMz+LMYaceZhflYWLUm4lg==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26448
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 460

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 368 KB
110 KB 8ms
8ms Script
text/javascript 2600:9000:2491:1600:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:1600:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:34 GMT
x-amz-version-id: K_BiY69MkQWIGXQ0IJYllFiclR8cuOtm
content-encoding: br
last-modified: Mon, 15 May 2023 17:06:25 GMT
server: AmazonS3
via: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
etag: W/"2ef186073651e0fd07f0cae2fa5d9d1f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 992
x-amz-cf-id: YrnscAXmq1ByaP_LnXNoNW3EdTXf9xEh-7ctE-O30P1xiLRAPAAvUw==

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
305 B 101ms
100ms XHR
text/plain 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3030&u=https%3A%2F%2Flogin2.demonyins.top
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:05 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
access-control-allow-origin: https://login2.demonyins.top
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: Zhn3vk_L6F0fB6mtM4vb_rhTtWT1c4pe19cjlJv1s-dN2H8PM4sWzA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 404ms
390ms XHR
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:07 GMT
x-amz-version-id: yHpogsakS7iCluwAmUa6Y9ccBYm32d5h
content-encoding: gzip
via: 1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Thu, 11 May 2023 21:16:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: ifhpajZ6HJeeIUmSVWiKrGWcSlXeDap7Omi0jHY1wOGdRUKafocVxA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
508 B 68ms
47ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=0&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%2C%7B%22sd%22%3A%22top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: NGWHDAXDP2MF378Z42G1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: HWVdNZV4RGTVDX-fyVGzoR1AN_5-XdFXUge2wjiAMHS3qM7KW79hNQ==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 75 KB
25 KB 183ms
134ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34c6dd7ed31bcefc95f660e8d64b202109f11fe010ae808b188f11623b8f6ca1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25446
x-xss-protection: 0
server: cafe
etag: 167 / 19492 / 31074557 / config-hash: 6508097778422352816
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/ 403 KB
125 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98a3ab26574717a95d200c12658c4dbbb28109a057cc52f8a100e6da2b645963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 21:19:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73349
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127561
x-xss-protection: 0
server: cafe
etag: 1000764176958695900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 13 May 2024 21:19:37 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 42 B
70 B 56ms
42ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=login2.demonyins.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10b02bf3ec4575faaa1dda7a1ef9a2ecce233df0bf36e6467f5458ef45e23618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
x-xss-protection: 0
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 42ms
42ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=1&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: MQP4PS7MTT95JB1YH5G0
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: zFHOh0C6SqIlS7i2uv9iog0a9pHE6A6abqLbJKUkXXN_Vv7TKkb37A==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 51ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=login2.demonyins.top

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 37ms
15ms Script
application/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=login2.demonyins.top

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 64 KB
18 KB 170ms
169ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=642039890918288&correlator=1799881049194288&eid=31072879%2C31074539%2C31074557&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fif&iu_parts=29390238%2Cnyt%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C970x90%7C970x250%7C1605x300&fluid=height&ifi=1&adks=2496155832&sfv=1-0-40&prev_scp=div%3Ddfp-ad-top%26pos%3Dtop%26amznbid%3D1%26amznp%3D1%26request_time%3D1286&cust_params=als_test_clientside%3Dreqfailed_reqfailed_reqfailed_20230515174206%26edn%3Dus%26test%3Dprojectvi%26ver%3Dvi%26typ%3Dhp%26prop%3Dnyt%26plat%3Dweb%26abra_dfp%3D%26sov%3D4%26page_view_id%3DIvTRy1k01IMK10WgjGPdJEF4%26purr%3Dfull%26vp%3Dlarge%26uap%3Dbrowser&sc=1&cookie_enabled=1&abxe=1&dt=1684172526345&lmt=1684172503&dlt=1684172525048&idt=1255&adxs=0&adys=15&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Flogin2.demonyins.top%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&ga_vid=2019307107.1684172526&ga_sid=1684172526&ga_hid=839229873&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe2348e120483e7fcac0533cbda1afc12e5aac50c30a1fffe3eac158e8a5c5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18726
x-xss-protection: 0
google-lineitem-id: 6294579579
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432200973
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A6D6 6 KB
3 KB 51ms
15ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:42:06 GMT
expires: Tue, 14 May 2024 17:42:06 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 446 B
779 B 43ms
15ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088370&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rf=https%3A%2F%2Flogin2.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login2.demonyins.top&tg_i.page=https%3A%2F%2Flogin2.demonyins.top%2F&tg_i.invCode=nyt_home_top&tg_i.pbadslot=%2F29390238%2Fnyt%2Fhomepage&tk_flint=pbjs_lite_v7.43.0&x_source.tid=5d5b0e65-7c52-42ef-8172-22e7cc852dce&l_pb_bid_id=2840793165d5fb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F29390238%2Fnyt%2Fhomepage&slots=1&rand=0.1626007875688411
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 72ebd562aa447fc1117146bea7c5e7bc1d76fdb3f17d3e809e77bca9ea715a5d

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login2.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 446
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
993 B 42ms
15ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin2.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login2.demonyins.top&tg_i.page=https%3A%2F%2Flogin2.demonyins.top%2F&tg_i.invCode=nyt_home_mid1&tg_i.pbadslot=dfp-ad-mid1&tk_flint=pbjs_lite_v7.43.0&x_source.tid=e6b6a53d-6e30-48ae-80c8-d3e28658c4d3&l_pb_bid_id=33d100e97e9bab&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4665493292716538
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f4c26865119bbda5a61aeb17d0112d12d1c2e4b856fae82debad19c4b5ff7d84

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login2.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
763 B 44ms
17ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin2.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login2.demonyins.top&tg_i.page=https%3A%2F%2Flogin2.demonyins.top%2F&tg_i.invCode=nyt_home_mid2&tg_i.pbadslot=dfp-ad-mid2&tk_flint=pbjs_lite_v7.43.0&x_source.tid=e778e4ce-6e80-42a2-8cd9-2cfe2798bfa7&l_pb_bid_id=45536cb1ab09ff&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8677092198884975
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 49d1147cb46ca2675c657b6e71544ef443bfe5d8b51552277a9c7b481d04f553

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login2.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
763 B 43ms
16ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin2.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login2.demonyins.top&tg_i.page=https%3A%2F%2Flogin2.demonyins.top%2F&tg_i.invCode=nyt_home_mid3&tg_i.pbadslot=dfp-ad-mid3&tk_flint=pbjs_lite_v7.43.0&x_source.tid=d8fe3745-2f85-4101-889c-1dc5b7ba68d8&l_pb_bid_id=5ba7ee48a7d0a8&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.2655521532116907
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f8673a6ef5346b440f71cdd7bca37da0ece0e6290f03e0c9bb9d62297401c3ba

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login2.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 434 B
767 B 48ms
22ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088374&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin2.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login2.demonyins.top&tg_i.page=https%3A%2F%2Flogin2.demonyins.top%2F&tg_i.invCode=nyt_home_bottom&tg_i.pbadslot=dfp-ad-bottom&tk_flint=pbjs_lite_v7.43.0&x_source.tid=45031501-0f25-4e63-be49-b3efa29a025f&l_pb_bid_id=6ba9e08abaca16&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.32386574856647377
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9543af1948131405c8094ce36e58c26be9a33ef4117644937081188b31a178c1

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login2.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 434
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 arj Show response
nytimes-d.openx.net/w/1.0/ 73 B
381 B 43ms
20ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://nytimes-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Flogin2.demonyins.top%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=5d5b0e65-7c52-42ef-8172-22e7cc852dce%2Ce6b6a53d-6e30-48ae-80c8-d3e28658c4d3%2Ce778e4ce-6e80-42a2-8cd9-2cfe2798bfa7%2Cd8fe3745-2f85-4101-889c-1dc5b7ba68d8%2C45031501-0f25-4e63-be49-b3efa29a025f&nocache=1684172526464&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250&divids=dfp-ad-top%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&aucs=%252F29390238%252Fnyt%252Fhomepage%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&auid=544112060%2C544112063%2C544112063%2C544112063%2C544112062&tps=aW52Y29kZT1ueXRfaG9tZV90b3A%3D%2CaW52Y29kZT1ueXRfaG9tZV9taWQx%2CaW52Y29kZT1ueXRfaG9tZV9taWQy%2CaW52Y29kZT1ueXRfaG9tZV9taWQz%2CaW52Y29kZT1ueXRfaG9tZV9ib3R0b20%3D
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: fa5db2ca049f83b8cd3f155021ef79de17b9ab65488141adc4888dcfd36f9d05

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://login2.demonyins.top
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 53 B
866 B 28ms
9ms XHR
application/json 37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:42:06 GMT
AN-X-Request-Uuid: a8c2b98a-9665-416c-a420-937b87c56a3a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://login2.demonyins.top
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 53
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
585 B 29ms
8ms XHR
application/json 18.196.86.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.43.0&referrer=https%3A%2F%2Flogin2.demonyins.top%2F&tmax=10000

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.86.54 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-86-54.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
accept-ch: sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform
x-auction-status: 3, 3, 3, 3, 3
content-type: application/json; charset=utf-8
access-control-allow-origin: https://login2.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 338 B
606 B 161ms
139ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU4WQK98
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: d339d9d854cbf06c598e32f1c2a6e9eadf831caea453a47dcf1405695e826a8e

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 container.html Show response
5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E980 6 KB
3 KB 9ms
9ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:42:06 GMT
expires: Tue, 14 May 2024 17:42:06 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame E980 7 KB
814 B 49ms
16ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b3fbd953664215264e3a7fb2c2c68a3826fe96c5801ffe3d79ad431cfb37b78a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 17:31:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame E980 24 KB
7 KB 37ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 09:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 202917
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 12 May 2024 09:20:09 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame E980 7 KB
1 KB 46ms
16ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&lang=de

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

97b9ca613f6d6854860aaf524d0dae463f58162d0e2db845d78713993c2b3370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 17:15:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 Baymax-1.2.2.js Show response
static01.nytimes.com/ads/adplatforms/cdn/ Frame E980 34 KB
7 KB 219ms
218ms Script
text/javascript 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://static01.nytimes.com/ads/adplatforms/cdn/Baymax-1.2.2.js

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

2cc6cfc6f07bc4cef11c2dee27ca861146085b4aeb618527bef97c9e2a1c54ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 27 Mar 2023 16:45:29 GMT
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 3397
x-guploader-uploadid: ADPycdtdiymtVdGicu6IXU3d7KB2wYgsFYyl2XDUyIiNcpm1fQt2-rW7us7a7O9HQqIlOqPfod6mfQacSOdHni8H_L2oT1RW0Mv2
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 6236
x-served-by: cache-iad-kjyo7100023-IAD, cache-gig2250055-GIG
last-modified: Mon, 27 Mar 2023 16:44:38 GMT
server: UploadServer
x-timer: S1684172527.690327,VS0,VE0
etag: "6b65754b2f2b9a52ececc373672351d1"
vary: Accept-Encoding
x-goog-generation: 1679935478565176
content-type: text/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=1vjgAg==, md5=a2V1Sy8rmlLs7MNzZyNR0Q==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 34872
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 14797, 31

GET
H2 200 14831738072326492778
tpc.googlesyndication.com/simgad/ Frame E980 3 KB
3 KB 38ms
8ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14831738072326492778?

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00cbd77067ec5e17df26c2bab2bb050ab6e0518598826993f80f5c68b67de24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 21:04:24 GMT
x-content-type-options: nosniff
age: 247062
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3039
x-xss-protection: 0
last-modified: Tue, 26 Jul 2022 15:46:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 May 2024 21:04:24 GMT

GET
H2 200 16907635383512523459
tpc.googlesyndication.com/simgad/ Frame E980 16 KB
16 KB 38ms
8ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16907635383512523459?

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4086733e752502e3527667e254f21490106433ea24b95b163ac3e32c3e75388

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 20:37:00 GMT
x-content-type-options: nosniff
age: 162306
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15946
x-xss-protection: 0
last-modified: Tue, 16 Aug 2022 19:53:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 12 May 2024 20:37:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E980 170 KB
53 KB 78ms
49ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3e707799c4b8c1017aaed1c78432af2cc213ea88229312c1b2d621aa0ade9ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53845
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684150324481819"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E980 0
0 46ms
46ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvyZJQdFFac21lNrRPAmpGaPnFir2N08s2t_Q0yufXRH-SZ0yBPx2BVwwqBlyPykJE-8Nxrn7TkfY7S7XS52xEWStMnkyDhAKshXY3pcRFC1CYGUJ-0wnXnQUsgH2aXn5CkzlXgKr_wtsC5du0V1wV9HRex9mZN3sB7kqjnASZJnglGo8YwYnutD4PG5pDDckRXSrGEvWE6yQlGFSeREEC7-sEkgoDly7v1BnUFdd307d_lsOBrMq2dAIkxXvAyvXESNicK0KK69vqKvi2EA8H9H6SJNEcTfiABsHdAt5uHBlNKb48XB_NVEZYYuNqolO-SFfAft9Kq1Vr2S4NJpMOZndkOdxvHytM25jwH-M_L9LvVyEIsp2E&sai=AMfl-YR6kDaE6ddTcfv6zR0UKzCm1U1cR3pAKLgX2mVgl3i8_0hrZ2z-XY0Wi0ADYhZ_hPFRbqwiZwfbG4WjcyRuhKWpOC1CZOAyn1wsaGyjqMxNT6jam07PymEmM_z3pQLclJrh5-X8jvXDLEpd7Y8r&sig=Cg0ArKJSzCPyM-6GWwGMEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 17:42:06 GMT

GET
H2 200 pause.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame E980 702 B
954 B 211ms
210ms Image
image/svg+xml 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/pause.svg

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

c9fb083529541e219ad17a00cb201b3dba9dabcdcc01eae4eb9ac04b8cb72216

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 11 Apr 2023 09:27:58 GMT
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 548047
x-guploader-uploadid: ADPycdslycHmK-Q5LXHGLtJG7hs3kRGRu1vUsvy9AW6dMZDy59SbW-QBHtnxn7pytkYC2V2pSVqaRY5M3VnoRj-6ZRlXfw
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 435
x-served-by: cache-iad-kjyo7100021-IAD, cache-gig2250055-GIG
last-modified: Wed, 11 Mar 2020 20:20:42 GMT
server: UploadServer
x-timer: S1684172527.932760,VS0,VE0
etag: "67652da3a119c795c417355d9e1ac31a"
vary: Accept-Encoding
x-goog-generation: 1583958042997649
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=GdvCsQ==, md5=Z2Uto6EZx5XEFzVdnhrDGg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 702
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 14572, 341

GET
H2 200 play.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame E980 681 B
861 B 211ms
210ms Image
image/svg+xml 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/play.svg

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8658fc44ca45cf40ee56d54bccb269e8cbca4ad85f1ea1bfbbc5faf127a7dec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 14 Mar 2023 09:48:42 GMT
date: Mon, 15 May 2023 17:42:06 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 546802
x-guploader-uploadid: ADPycdsGMNtuXmQl2AOg3iJqXzX2hCY-cBYwKm6quptazfHa3qjuypYsADGN1239BYPxDMal2So2Mt0mmV8LPXl0K3y_agq02AHZ
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 440
x-served-by: cache-iad-kjyo7100077-IAD, cache-gig2250055-GIG
last-modified: Wed, 11 Mar 2020 20:20:43 GMT
server: UploadServer
x-timer: S1684172527.932746,VS0,VE0
etag: "ac79f9cf6aa8bd6f20fc5bc3a629e040"
vary: Accept-Encoding
x-goog-generation: 1583958043497355
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=9xm5Gw==, md5=rHn5z2qovW8g/FvDpingQA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 681
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 13836, 436

GET
H3 404 ads
5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E980 2 KB
2 KB 118ms
117ms Image
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ads

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4591eed27abff378652a507923552094808684c88965a1f19a163b684b6616e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1586
x-xss-protection: 0

GET
H2 200 franklin-normal-500.woff
g1.nyt.com/fonts/family/franklin/ Frame E980 26 KB
27 KB 234ms
234ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-500.woff

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

88011d782fa21da0ec301e49080fa9950973db277a33674d252f0fe1e333f61f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
Origin: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 01 May 2024 10:53:01 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1147745
x-guploader-uploadid: ADPycdtqabfwtzNf7_UVsElknqtuTRS3MwMP6APgD5QCCP7iPSb40uFLYpKTkGfu4zv9Rfq8ltcrnO1GM_fLdjPpdTm2tA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26600
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172527.937437,VS0,VE0
etag: "cb85480c30b6ca5f53f673993211036f"
x-goog-generation: 1673991776240638
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=kksIKQ==, md5=y4VIDDC2yl9T9nOZMhEDbw==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26600
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 15

GET
H2 200 franklin-normal-700.woff
g1.nyt.com/fonts/family/franklin/ Frame E980 26 KB
27 KB 223ms
222ms Font
application/octet-stream 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-700.woff

Requested by

Host: 5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

640a9138e66deb5b745997e8dbe0be6e4c32d82da5710f9cea8afb0bee2f3bbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
Origin: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 24 Apr 2024 07:18:32 GMT
date: Mon, 15 May 2023 17:42:06 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1765414
x-guploader-uploadid: ADPycdvKi3s93PYAdPAwEDNsdTcmQWVaVFIACe5j6qv1G51_Ruxax4rv_UeWsMxSxIZcucKSEY_-mnNFtIsa_LFTKGPzwA
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 27032
x-served-by: cache-gig2250048-GIG
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172527.937383,VS0,VE0
etag: "ab057a3b069a4ecbde7c3ea74411284e"
x-goog-generation: 1673991776263300
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=Rh/wYQ==, md5=qwV6OwaaTsvefD6nRBEoTg==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 27032
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 35

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame E980 13 KB
13 KB 27ms
6ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 17:12:56 GMT
x-content-type-options: nosniff
age: 347350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 17:12:56 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E980 0
0 46ms
46ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvDzx5s3VhCk0hL0jeeZ-I478ldPqDi8ilFqgfpdKWE8JmMh2h_Pa1_Xg-WzW8QC0K56_VxvkllGvSMPsR31Bxm3I2OYVlyIX_YMAXRD4Xpx7pzZP244h4zbET1XEKEAZ6nfG4UZ4JjUyKKLt4yS3eoTWEgHcKu-P_kUUcKy26OGGUWHcZPDkt_wBSrpwjmmdW6-3LwYUvqGtgdaJCmxPuxcrENuisJH2Whc8FWEyKctAvR85JAhVHAZTHa_UUvQC9Ls_XLbI60iEDVocOdBYehFNP75BMkdIiV6lrBqpbh9IpAEBdOQOg08wv4jbj_UCkjcryfbQw5volPp1kv&sai=AMfl-YRP0y5zsV4kcUUJ22Kks4aKIyCeu11_Cx6civCvYzqmBWHFCLgwNEWDlKZpPZHI56WRL-ZL8fvcQrvM4rOcvTvCgs5nZUIdN_4KYNU43km0Kz3Jbb2Y6EinMVd-Wa6RiYYqGfYiuJrk44AJHoM5&sig=Cg0ArKJSzISrDkktj-KeEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 17:42:06 GMT

GET
DATA 200
OK truncated
/ Frame E980 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8077ba7f17c4f87be60472add569ee1c02846793a8c019ebf77d236e024570ab

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js Show response
login2.demonyins.top/vi-assets/static-assets/ 45 KB
16 KB 627ms
626ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtCV-PKxiVphIO8DI9lDxPjrmytMOvu0OpHui-fUvU1cE8oD-DWNyyDkJTv4XVb6Q_kxW-HjCfklDLSlYsLKtMDVL8zWA3f
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-25 13:31:49 UTC
x-served-by: cache-sna10751-LGB
x-timer: S1684172527.487351,VS0,VE1
etag: W/"43c291b8f09c16e8d0f62d9520c31af0"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1682344117620870
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 14688
expires: Wed, 24 Apr 2024 13:31:49 GMT
date: Mon, 15 May 2023 17:42:07 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 13:48:37 GMT
server: cloudflare
x-goog-hash: crc32c=TXHOfA==, md5=Q8KRuPCcFujQ9i2VIMMa8A==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LwgHfM62U1BV73Y%2FkeDNb621hkt7Rdpz%2FpYydzK3NW9BAoFiPjnzI1hldAweL4ZoheBlVYy%2FuFndSkFuPWsi3ipBaIOBIbh9t8pVDroxBWVk7eHTvVSktlhneruCg8pumtEfrvxwu622Wtgn6qr%2FR%2FUKuw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 46523
cf-ray: 7c7d2cf63a5e39ce-FRA

GET
H3 200 vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js Show response
login2.demonyins.top/vi-assets/static-assets/ 21 KB
6 KB 518ms
517ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsU-Y6dF4iuOdlbDzMiTUlyTvwtD2glVJVJ-H-l6sC7wVdNKyfgeH_EumbkZ9dbPhat7g224JVSJsLi4nMdDxTCnQ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-19 16:29:35 UTC
x-served-by: cache-sna10722-LGB
x-timer: S1684172528.509923,VS0,VE1
etag: W/"1e07834fc5f5299ca69c83a2dfb0dded"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1681921580764142
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 20966
expires: Thu, 18 Apr 2024 16:29:35 GMT
date: Mon, 15 May 2023 17:42:07 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 19 Apr 2023 16:26:20 GMT
server: cloudflare
x-goog-hash: crc32c=blhS2g==, md5=HgeDT8X1KZymnIOi37Dd7Q==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7z6DezT8sKGAxTqF%2FkcuRj0LGLN49tPTuVLUNyGHlMjtsWj%2BlC4sXjaNaf1u99QNeX%2F60tU%2Bc8zPMz5h4XAwKPaJNnAkpz2SzX4InEAGfGY6V4x4KoxRWA2FfSD%2Fq7nUillrwH3r%2Bx8zQc74oVFuSsIZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 21721
cf-ray: 7c7d2cf63a6339ce-FRA

GET
H3 200 vendors~home-7fa14ae6eded78270c01.js Show response
login2.demonyins.top/vi-assets/static-assets/ 535 KB
112 KB 710ms
709ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvb3dt1AVtdeD8gjhBg0Qs9kq1uTWStqC5xgH3CQuxECnyWgFMwW0yv_oSUCnbFY-597CnnmqWPGQL5Dt9y2J6mptiL2ZIZ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-11 14:43:50 UTC
x-served-by: cache-sna10721-LGB
x-timer: S1684172527.497771,VS0,VE1
etag: W/"d80eeecdbf266544f4fa8d236f58eb6f"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683816008978436
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 5617
expires: Fri, 10 May 2024 14:43:50 GMT
date: Mon, 15 May 2023 17:42:07 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 11 May 2023 14:40:09 GMT
server: cloudflare
x-goog-hash: crc32c=FKch7g==, md5=2A7uzb8mZUT0+o0jb1jrbw==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z2qOx4D3SJFPJe6gWKwGorg290gO5JHRdMu2WpThXbCCVohuqOLv6htaklnCIvYO%2FSh9RvdRwc1YtosAgPT7IUrVPlTL8Q0EwJHgtyL7F8J1cSuiBIDd03htitAz4tAp77QOwM8HMXtSN9i%2ByzEdD7VqWg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 548235
cf-ray: 7c7d2cf63a6739ce-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 122 KB
43 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N5P6T9S&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cf39605b08318630a6d3a15b4ba3974185951acfac5ce7c94025bfae500ae604

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44203
x-xss-protection: 0
last-modified: Mon, 15 May 2023 17:16:56 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 May 2023 17:42:07 GMT

GET
H2 200 tags.js Show response
dd.nytimes.com/ 266 KB
55 KB 30ms
7ms Script
text/javascript 143.204.215.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/tags.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.97 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-97.fra53.r.cloudfront.net

Software

Apache /

Resource Hash

078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
via: 1.1 598a1f878f2efc16baaf47787ffe82d2.cloudfront.net (CloudFront), 1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
date: Mon, 15 May 2023 17:25:41 GMT
x-amz-cf-pop: FRA60-P2, FRA53-C1
age: 986
x-cache: Hit from cloudfront
content-length: 55493
last-modified: Fri, 05 May 2023 08:25:33 GMT
server: Apache
etag: "42845-5faee086486b0-gzip"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3600, public
accept-ranges: bytes
x-amz-cf-id: izMnotWT9hyah99SsNKzlCm5Q-a1wBocLLap7PuiP5R7uTns5vCbBw==
expires: Mon, 15 May 2023 18:25:41 GMT

GET
H2 204 b
sb.scorecardresearch.com/ 0
228 B 34ms
8ms Image
text/plain 13.32.99.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=3005403&ns__t=1684172527166&ns_c=UTF-8&c8=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&c7=https%3A%2F%2Flogin2.demonyins.top%2F&c9=
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-105.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:07 GMT
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: RxJGJBEOAxVrCWn_DN_RYp_RCmnOD7kML1GmpHr9ABPgjhKpN3Zx_g==
x-cache: Miss from cloudfront

GET
H2 206 101984_1_MKTG_Games_SpellingBee_Concept2_v1_Desktop_2022_wg_480p.mp4
vp.nyt.com/video/2022/08/16/ Frame E980 1 MB
1 MB 219ms
218ms Media
video/mp4 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://vp.nyt.com/video/2022/08/16/101984_1_MKTG_Games_SpellingBee_Concept2_v1_Desktop_2022_wg_480p.mp4

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d85711c9a360bc75ca701f1a12e6716f1d0e29df71130cd033c38d2b93cf36ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=0-

Response headers

expires: Wed, 19 Apr 2023 18:18:40 GMT
date: Mon, 15 May 2023 17:42:07 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 20165
x-guploader-uploadid: ADPycdsm9eR52j4Tv1wt_67cgxsXmEuARbKCZtTF4AXALWcwmLYOD9ofFu5597tDml2Ba1rgYYnXIL9SuXwBeuBsNCT_Cg
x-cache: MISS, HIT
x-goog-storage-class: REGIONAL
Content-Range: bytes 0-1183869/1183870
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Content-Length: 1183870
x-served-by: cache-chi-klot8100056-CHI, cache-gig2250055-GIG
last-modified: Tue, 16 Aug 2022 14:08:56 GMT
server: UploadServer
x-timer: S1684172527.303165,VS0,VE1
etag: "8f176523096b80966f2cc00a0441b497"
x-goog-generation: 1660658936001125
content-type: video/mp4
access-control-allow-origin: *
x-goog-hash: crc32c=BI1Tyw==, md5=jxdlIwlrgJZvLMAKBEG0lw==
cache-control: max-age=60, s-maxage=86400, stale-if-error=86400
report-to: {"group":"gfe-default_product_name","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/default_product_name"}]}
x-goog-stored-content-length: 1183870
access-control-allow-methods: GET, HEAD, OPTIONS
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="gfe-default_product_name"
x-cache-hits: 0, 0

POST
H2 200 / Show response
dd.nytimes.com/js/ 240 B
626 B 28ms
13ms XHR
application/json 143.204.215.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/js/

Requested by

Host: dd.nytimes.com
URL: https://dd.nytimes.com/tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.97 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-97.fra53.r.cloudfront.net

Software

DataDome /

Resource Hash

8cfb0ab8d7f169f0fc590e4c6da6a0c7e990fc1242e674068bf5af06a9f8b0b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:07 GMT
via: 1.1 8d31bbd9d6638cdacab37047b8045da4.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000; includeSubDomains; preload
server: DataDome
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 240
x-amz-cf-id: -I6Auy-6sRSoYh_e7pmADeG-XVMAKyd1ijMAsrNq4zrJdCw6BDifYQ==
expires: 0

POST
H2 200 track
a.et.nytimes.com/ 0
0 120ms
119ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 215ms
214ms Preflight 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login2.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 2
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:42:08 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 1
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 16
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: HE
x-samizdat-query-exe-id: b458a06032acd647
x-samizdat-query-field-errors: 0
x-served-by: cache-gig2250076-GIG
x-timer: S1684172528.227408,VS0,VE1

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 214ms
214ms Preflight 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login2.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 2
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:42:08 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 2
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 16
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: HE
x-samizdat-query-exe-id: 81a7542414ee9b9c
x-samizdat-query-field-errors: 0
x-served-by: cache-gig2250076-GIG
x-timer: S1684172529.512819,VS0,VE0

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET
H3 200 market Show response
login2.demonyins.top/api/ 516 B
1 KB 499ms
499ms XHR
application/json 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login2.demonyins.top/api/market

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab011b127403d86c7e7e9ab59ee46278c99dfbd943a2e7bd1f068177d8961c13

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-F-X
age: 40
x-cache: HIT, HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-time: 2023-05-15 17:41:29 UTC
x-served-by: cache-lga21927-LGA, cache-sna10744-LGB
server: cloudflare
x-timer: S1684172529.695081,VS0,VE1
vary: Accept-Encoding, Fastly-SSL
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/api/market
x-cloud-trace-context: f8f84e0e61ae5cadf9ffb3dd90f4e11c/6270760145105657226;o=1
cache-control: s-maxage=60,(null)
x-nyt-route: market
x-nyt-app-webview: 0
x-gdpr: 0
x-nyt-edge-cache: HIT-HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qp5kIRJQtL79PQT5bSvafBJpLDCrl9lMrvo%2Fas%2BwDXc9%2FXv3ZAV0DUzzCU65ASKCGBoZo52nLQQbpd1KqQCSpt95NynrGuXJ0ylk7vfvwbIA3Ew3yWzhLXzyjV9j3FLPhej%2F%2FKr%2BuQxH6wdEoWzIeMCuwA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7c7d2cfdbe1039ce-FRA
x-cache-hits: 49, 2

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
464 B 40ms
39ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=2&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid1%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid1_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: EYAJTR3RR612VSHR1JDY
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: pTnzBidFVVT2OU0kVb2q_1rvYst12inuKPS85niaBVK9yE5RKBm-Aw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
464 B 39ms
38ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=3&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid2_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: KM0JNYXENCCGY45YBYF6
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: NR1u8VjyekdcdRi6oRvRxc5c1mushGsTUdnv9b8QQNi9SEaKt-hN9A==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
464 B 40ms
40ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=4&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid3%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid3_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: MY7Y7V1SGGQ1YEXB7WHH
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: FJt2-WIpC8Xvm8sjJ_F2f-gt2QBoQ7Hc5NadMJT5xqabsJZ3lB3vgg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 40ms
40ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin2.demonyins.top%2F&pid=zCW8KuNw0F0Ab&cb=5&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-bottom%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-bottom_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: TRYFKFRPA0HHWD4DBKR5
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login2.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 7ZwaTGjXWNDciTjfe90f7DZ-H4s1ck8kplNWGdlXzv66vgxBXWKsRQ==

GET purr-cache
purr.nytimes.com/v1/ 0
0

GET data-layer
a.nytimes.com/svc/nyt/ 0
0

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET meter.js
meter-svc.nytimes.com/ 0
0

GET
H2 200 15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/ 42 KB
43 KB 212ms
210ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:50:48 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 3080
x-guploader-uploadid: ADPycdt7tECLWNzUgQmhm7aJiAazNCgpAzASUrldbO7xItpk9zJG1d6Sd_sYdTKVpvhQzZLdk_qZT9wdS3zuJM0M1FH9m96TgkTK
x-cache: HIT, HIT
fastly-io-info: ifsz=84718 idim=600x400 ifmt=jpeg ofsz=43296 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 43296
x-served-by: cache-iad-kjyo7100050-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.803785,VS0,VE0
etag: "mFlQssjSaYGsDP6scpTKnUwwQj9tGr0hMknU2SVmwaQ"
vary: Accept
x-goog-generation: 1684168944776482
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=AVmsLw==, md5=wv06VVVo5l+mm2wQ3uuI+w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 84718
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 61, 12

GET
H2 200 15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/ 52 KB
53 KB 223ms
221ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:15:35 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30393
x-guploader-uploadid: ADPycdvOJo6J6Kg_uMjDSIklBuvK9ggwejxNEIcbg0RV7W80HRf3n_8ZEs_DzPHlSQtAc2mQFKg6UBpS6kxTt-O-iY3lRuWCgMte
x-cache: HIT, HIT
fastly-io-info: ifsz=81973 idim=600x400 ifmt=jpeg ofsz=53086 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 53086
x-served-by: cache-iad-kcgs7200048-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.805004,VS0,VE0
etag: "mjex0YFIaGMauq6Z27qq2hoxCwoLi6eRCHGqkYUC7N8"
vary: Accept
x-goog-generation: 1684141861821066
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=UoW/hQ==, md5=iuJG/usWsGY3yiQD7UipfA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 81973
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 105, 123

GET
H2 200 15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/ 68 KB
69 KB 218ms
216ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:02:16 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9592
x-guploader-uploadid: ADPycdsPgjMPw4l2gHOyIJp0hSvt1dtbrswC2WcTTqSEnSJXOBD44XL71UxQBd_8goBdqjwK-B6h-rgRuYCGA5FZ8kpbq7_I7Vxp
x-cache: HIT, HIT
fastly-io-info: ifsz=123269 idim=600x400 ifmt=jpeg ofsz=69756 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69756
x-served-by: cache-iad-kcgs7200057-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.804708,VS0,VE0
etag: "pH2zxBFpvsIXrmS4qyQIN87EPO0lqzsbeOrH5wcVRSw"
vary: Accept
x-goog-generation: 1684162829216873
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=tNUH8g==, md5=zsrygEMi2fUGaOk0j76Tyw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 123269
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 40, 44

GET
H2 200 07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/ 19 KB
19 KB 215ms
214ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:54:22 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 24466
x-guploader-uploadid: ADPycdvmDL8ZgCsRvIz_Ar8ksTCbZoSyfAI6BfUrnPRbOalF0rWge_fSoyUxn-sex58YMaUWRJeKmVImM_w78evSHPYjJzzTfUfm
x-cache: HIT, HIT
fastly-io-info: ifsz=56087 idim=600x400 ifmt=jpeg ofsz=19066 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 19066
x-served-by: cache-iad-kjyo7100114-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.804419,VS0,VE0
etag: "KBtlA1V4WjHTNE5V50RLyY/u24LSmj+pPL5CLJTI+cI"
vary: Accept
x-goog-generation: 1684148059156533
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=2KTzAw==, md5=us+yx5g7w4NAonxxJSGi3Q==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 56087
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 56, 62

GET
H2 200 00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/ 29 KB
30 KB 216ms
215ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:04:53 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 27436
x-guploader-uploadid: ADPycdtYIsWQJossjbhj4NE9a7V60nF5ZGVKOxUOLgPwuHwxvH4NtIWgiU9TtfIc046nakfEovrSMU6IYcZsdFp7WkfIliD-DEfk
x-cache: HIT, HIT
fastly-io-info: ifsz=71618 idim=600x400 ifmt=jpeg ofsz=29698 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 29698
x-served-by: cache-iad-kjyo7100022-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.804388,VS0,VE0
etag: "FDp0NuTD9QQyweOM80tqrF1pjtB1wa8AuYDWlC3Rb2E"
vary: Accept
x-goog-generation: 1684145091884843
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Tesl+Q==, md5=658p2WygCMQ2Wh3b4dNgQQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 71618
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 65, 92

GET
H2 200 00ny-collapse46-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/ 35 KB
35 KB 227ms
226ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:02 GMT
date: Mon, 15 May 2023 17:42:08 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30247
x-guploader-uploadid: ADPycdv-RjySkmz9WN3ne-kS8XkSmDpu2M6UEqxVZ_hJxTqgYl13bNrG7lzDqe5PHmrEAGdVI4IqhxJd8IDRqRC8IHkoCgh-wApL
x-cache: HIT, HIT
fastly-io-info: ifsz=72756 idim=600x400 ifmt=jpeg ofsz=35602 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 35602
x-served-by: cache-iad-kcgs7200126-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.805304,VS0,VE0
etag: "EBg/5enaCAm22vhecGWWQjzDtdp98AwlyJ4FV5HmEW4"
vary: Accept
x-goog-generation: 1684001402069039
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=oNOYjw==, md5=IXx5X5yvxYHyirVzj6vr4g==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 72756
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 31, 84

GET
H2 200 00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg
static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/ 65 KB
66 KB 212ms
211ms Image
image/jpeg 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:07:57 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 5651
x-guploader-uploadid: ADPycdtCGv5m6PceHDXlLSckqGlLGNyqushN1GQ6Ixd2mTQ9ihKbp-8ZMjyo0gdnz-q3GOB6moU3c-TmiqTuvrk3M0Jvhg
x-cache: MISS, HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 66716
x-served-by: cache-iad-kcgs7200049-IAD, cache-gig2250055-GIG
last-modified: Mon, 15 May 2023 16:07:38 GMT
server: UploadServer
x-timer: S1684172529.019921,VS0,VE0
etag: "a68953e9f5a95550f641efdcb12f727e"
vary: Accept
x-goog-generation: 1684166858419715
content-type: image/jpeg
access-control-allow-origin: *
x-goog-hash: crc32c=0DccLQ==, md5=polT6fWpVVD2Qe/csS9yfg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 66716
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 21

GET
H2 200 15ruck2-zqvw-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/ 10 KB
10 KB 212ms
211ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/15ruck2-zqvw-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:32 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30217
x-guploader-uploadid: ADPycdtT4oOtzqWtr1DYT7-hNJKPs3x3iguLUcEQO5FC0gS6QU9KAtqJpXpn6qzviAlIE8j5WHcOB4e3oJaUFry2X2P3gSDlY2dt
x-cache: HIT, HIT
fastly-io-info: ifsz=32537 idim=600x400 ifmt=jpeg ofsz=10262 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 10262
x-served-by: cache-iad-kjyo7100030-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.019860,VS0,VE0
etag: "Nn9Fc+ga/54Cj2NJuIvHNU20MVEJoa6AvLbZOlLaocY"
vary: Accept
x-goog-generation: 1684141210191243
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=mMH/JA==, md5=xqnKhT2J+OYca+8khFn2Tg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 32537
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 49, 32

GET
H2 200 15gopnik-lead-square320.jpg
static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/ 6 KB
6 KB 215ms
215ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:57:31 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 27878
x-guploader-uploadid: ADPycdt2bG3FXkzTWJAn1XUiCBR_hN6GrQXtPWZ1FVZEb1VXdMSMJitck006nQNw0EPt3LD2QVJZflcARRU9w1UaFXBOPw
x-cache: HIT, HIT
fastly-io-info: ifsz=20438 idim=320x320 ifmt=jpeg ofsz=5768 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5768
x-served-by: cache-iad-kiad7000097-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.021178,VS0,VE0
etag: "+qddYcOpcEVbO/bCVPeXQafiajdnP1HWulXjJZSPyzI"
vary: Accept
x-goog-generation: 1684141211789042
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=/ljFcg==, md5=omJtgaEA0CKsZnwPOxCsMw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 20438
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 67, 242

GET
H2 200 margaret-renkl-new-thumbLarge.png
static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/ 22 KB
23 KB 211ms
210ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 25 Apr 2023 09:51:40 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 28345
x-guploader-uploadid: ADPycdvjCUwFCcvhVSzO-2xzXvTrDQpnR0UmL2TLI63uLPaDulk4nht84hxrX3vpG_b_GJFTfRRhWXWNTg3G_uQfqIUNLg
x-cache: HIT, HIT
fastly-io-info: ifsz=36961 idim=150x150 ifmt=png ofsz=22640 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 22640
x-served-by: cache-iad-kjyo7100130-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.025968,VS0,VE0
etag: "hoVlFIxH7rLt0KmY17hVz55a8Xab/9s6RZJLHlnaplo"
vary: Accept
x-goog-generation: 1681313959579894
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=XC9hiQ==, md5=d6vtrjCtKDtlp1puQ08jOQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 36961
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 54, 283

GET
H2 200 15villavicencio-ktlv-square320.jpg
static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/ 11 KB
12 KB 210ms
210ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:53:29 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 6518
x-guploader-uploadid: ADPycdvimGqnj-Y47l4DIQ2uo_xiQjY7fHmipyQWgGIyF5Ye0R5EzgJB0gsQeRpJdQRZ5UXEp2v2s_k1gRKmb0vbVfvxT4CsoZcQ
x-cache: HIT, HIT
fastly-io-info: ifsz=31329 idim=320x320 ifmt=jpeg ofsz=11388 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 11388
x-served-by: cache-iad-kjyo7100086-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.031055,VS0,VE0
etag: "bG9hTdIdRNlMs+IVIJs7SovdpEUwvvlclNd08GtoNYI"
vary: Accept
x-goog-generation: 1684141217907804
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=lmeGLQ==, md5=L2ogKVDcu2UBqSvV6azw6w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31329
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 46, 47

GET
H2 200 david-french-thumbLarge-v2.png
static01.nyt.com/images/2023/01/10/opinion/david-french/ 18 KB
19 KB 210ms
209ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 04:30:50 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 47477
x-guploader-uploadid: ADPycdugQRaxhuy3NhKo7Gtk7Y8i7o7E2DfOvecUWSG15XqVk0Oenvgx82t992x0rGHgLJ5t2ZQnTEx4dMNIHUZw3sXdHzaAEzwS
x-cache: HIT, HIT
fastly-io-info: ifsz=29917 idim=150x150 ifmt=png ofsz=18472 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18472
x-served-by: cache-iad-kcgs7200099-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.031834,VS0,VE0
etag: "UHMslo9fQpXlqe4rzWoQP7xQ8lwHh2b+h+7eIbfguhw"
vary: Accept
x-goog-generation: 1679948948755521
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Os64Sw==, md5=ik813eCgSskbkzQKQl7kCA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 29917
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1973, 288

GET
H2 200 the-daily-album-art-square320-v5.jpg
static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/ 4 KB
4 KB 210ms
210ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 17:00:56 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2471
x-guploader-uploadid: ADPycduyRA4n-gUc82OBqk5k7l2TJuAgrd2LOEcVdOy6HB_dBl0DkF2cr1KE4clXHXKs1t9xph_H8VMqD6aUpAo8kn9ufA0M3t0n
x-cache: HIT, HIT
fastly-io-info: ifsz=15986 idim=320x320 ifmt=jpeg ofsz=3614 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 3614
x-served-by: cache-iad-kcgs7200066-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.232088,VS0,VE0
etag: "HnnVz93O4bK0D9Smvlwnf0lv96YmNmLNlX7IWtdXh7Q"
vary: Accept
x-goog-generation: 1676481259772829
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=JiXB7Q==, md5=PfDXw6toN2ZQvpOKxIlHug==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 15986
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 6251, 19

GET
H2 200 the-morning-icon-square320.png
static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/ 18 KB
19 KB 210ms
209ms Image
image/webp 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 13 Apr 2023 07:16:16 GMT
date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 477302
x-guploader-uploadid: ADPycdsetZT2qsfezPZ6fhuIPsK8Jj91KHdz4FbF1nEA3yZt8R_SlNFNT_ElxmH1Lp1vTQkgDPDf56tfHU4M7OjKGd-Z
x-cache: HIT, HIT
fastly-io-info: ifsz=28435 idim=320x320 ifmt=png ofsz=18846 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18846
x-served-by: cache-iad-kiad7000149-IAD, cache-gig2250055-GIG
server: UploadServer
x-timer: S1684172529.237358,VS0,VE0
etag: "fvmiwkoVSucPkCQm5zWXms48Wd/eA+b71aA/zw+i3+w"
vary: Accept
x-goog-generation: 1647343871193623
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=ySN2bw==, md5=zI0rsfov1F0wMhGvqBk3Qg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 28435
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 889, 209

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 15 May 2023 16:35:39 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 3989
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 15 May 2023 18:35:39 GMT

GET
H2

200

activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~... Show response
5290727.fls.doubleclick.net/ Frame 2CD3
Redirect Chain

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=...
https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%...

455 B
358 B

56ms
55ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

cd537ad544dec1bbf725941a8134683bf3ffdb4bc5ce64f9db41197e96447ebe

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 248
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:42:08 GMT
expires: Mon, 15 May 2023 17:42:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:42:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 70 KB
24 KB 23ms
7ms Script
application/x-javascript 2600:9000:2057:6000:18:1fcd:351:7bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 03:24:56 GMT
content-encoding: gzip
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Thu, 08 Dec 2022 17:02:37 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 51432
etag: W/"639218ad-11856"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-amz-cf-id: 2bYCj7YNuV9-xkH6gtMVzEIqwRxsZoIEr0WiLt4mklI9NRqPsNMosQ==
expires: Tue, 16 May 2023 03:24:56 GMT

GET
H2 200 show-ads.js Show response
a1.nyt.com/analytics/ 45 B
648 B 210ms
209ms Script
text/javascript 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/show-ads.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 19 Apr 2023 09:06:51 GMT
date: Mon, 15 May 2023 17:42:08 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30679
x-guploader-uploadid: ADPycduLP9iQZw3FpLN6AFk0Bm7bF26DL-z6HbtI3jChDEKvmcD-rOT5CQXHIKekqB_Ijf-wkAz8ge5_sQjtFQOINENQyw
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 65
x-served-by: cache-gig2250055-GIG
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172529.902111,VS0,VE0
etag: "1d291da792456bd015b664ee1119a5e0"
vary: Accept-Encoding
x-goog-generation: 1640215841852360
x-goog-hash: crc32c=nM1/Pw==, md5=HSkdp5JFa9AVtmTuERml4A==
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 45
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 976

GET
H2 200 comscore-streaming.js Show response
a1.nyt.com/analytics/ 103 KB
19 KB 211ms
210ms Script
text/javascript 151.101.65.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/comscore-streaming.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 20 Apr 2023 05:38:32 GMT
date: Mon, 15 May 2023 17:42:08 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 42668
x-guploader-uploadid: ADPycdsyIRBvELABuE5Ku4Mwv3Z58eAzYpyt_mreR-R-gDDpvmUR-22_MSx1ea8150Rpu78LdB8bgv8OaWviHfj872EL
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 18717
x-served-by: cache-gig2250055-GIG
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172529.902226,VS0,VE0
etag: "04e0b9556a78ce5cedf86a34e5483036"
vary: Accept-Encoding
x-goog-generation: 1640215841902856
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=XkdIyw==, md5=BOC5VWp4zlzt+Go05UgwNg==
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 105675
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 861

GET
H2 200 nyt.js Show response
cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/ 4 KB
2 KB 34ms
16ms Script
text/javascript 2606:4700:20::ac43:4842
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/nyt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 15 May 2023 17:28:26 GMT
server: cloudflare
age: 822
cf-polished: origSize=4725
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u67fOBVJEmnioJlber0AIe%2BHp6OzR0YX4TqZq0sIoTN%2FVYrBL6uoFN1MF%2FCgeI%2Fc7w4Q719lHu0GZj7%2FCKgMUTsRfXDlT%2BYMUwZcXWuXWVfYzKReAZROejdCm0s6%2B%2Bga4U4OP0IItvEctLZM%2BH%2F2FaC2"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d2d011f7818d5-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E980 42 B
404 B 133ms
111ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvNR82sI3n2Kd2HcMyO4RELqAZJKAXjCahHaTB1SkHjLKmnXLJ5vEVtU09pRXKbix5X8KZbnBKr5tbW3uTlpr_Z_B14q8ZvGtFslinA4az5uH8e5pSx&sig=Cg0ArKJSzJMJxuyd-t2EEAE&id=lidar2&mcvt=1601&p=31,0,301,1600&mtos=1601,1601,1601,1601,1601&tos=1601,0,0,0,0&v=20230515&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=7&adk=2496155832&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684172526544&rpt=275&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
211 B 14ms
14ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&aip=1&a=839229873&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nytimes.com%2F&dr=&ul=en-us&de=UTF-8&dt=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABAAAAACgBM~&jid=417333797&gjid=1416635978&cid=2019307107.1684172526&tid=UA-58630905-7&_gid=1764503220.1684172529&_r=1&_slc=1&gtm=45He35a0n71P528B3&cg1=homepage&cg2=null&cg3=homepage&cg4=null&cd1=https%3A%2F%2Fwww.nytimes.com%2F&cd2=https%3A%2F%2Flogin2.demonyins.top%2F&cd3=&cd9=9&cd10=null&cd13=null&cd14=null&cd15=earned&cd16=referring_links&cd21=Homepage&cd26=null&cd27=null&cd28=null&cd29=null&cd30=null&cd36=&cd42=nyt-vi&cd48=null&cd49=&cd51=nyt-vi&cd52=&cd54=null&cd57=0&cd58=0&cd59=&cd60=&cd67=0&cd95=&cd122=&cd123=&cd124=&cd125=&cd126=&cd127=&cd129=NaN&cd135=&cd139=&cd141=&cd142=&cd162=&cd163=&cd172=desktop&cd173=desktop&z=1424871214

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://login2.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
pnytimes.chartbeat.net/ 43 B
201 B 424ms
98ms Image
image/gif 54.165.163.91
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pnytimes.chartbeat.net/ping?h=nytimes.com&p=nytimes.com%2F&u=BMmH-kCx7WH2D5kzbM&d=login2.demonyins.top&g=16698&g0=Homepage&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=11688&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Flogin2.demonyins.top%2F&b=5039&t=CzM3BVJDwKPEXlSVvIbyDC701ta&V=139&i=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&tz=0&sn=1&sv=DbTn6kD8-fz1VobixD3d7eRBUye4S&sd=1&im=06672fd3&_
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.163.91 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-165-163-91.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 17:42:09 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
expires: 0

POST
H2 200 track
a.et.nytimes.com/ 0
0 217ms
216ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 65568.js Show response
cdn.brandmetrics.com/scripts/bundle/ 46 KB
15 KB 81ms
81ms Script
text/javascript 2606:4700:20::ac43:4842
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login2.demonyins.top
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 17:42:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2FtfZYSCFNeJ6Va3%2BZeljRTZ0URI2S4mF7im3%2B%2FCT5mCFzL0A%2FS5Bz3YNyh64hgw7SCgoNxDG8s%2FoFTmkdGHPDscO1rSe38tPEfNh2V7%2F4yaoppwxUBes3dyCRo6BWUzbotJ9WQQ%2F8KnS77VSHSIaNxK"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d2d02494318d5-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

GET
H2 200 dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demo...
adservice.google.com/ddm/fls/z/ Frame 2CD3 42 B
262 B 47ms
47ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F

Requested by

Host: 5290727.fls.doubleclick.net
URL: https://5290727.fls.doubleclick.net/activityi;dc_pre=CMn4ycrv9_4CFcXwmgodbgkNBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3866013320080;gtm=45He35a0;auiddc=1583729849.1684172529;u17=https%3A%2F%2Flogin2.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin2.demonyins.top%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5290727.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
143 B 115ms
52ms Script
text/javascript 20.50.2.28
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login2.demonyins.top&rnd=7814791
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login2.demonyins.top
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.50.2.28 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937
date: Mon, 15 May 2023 17:42:08 GMT
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H2 200 .status
a.et.nytimes.com// 0
0 121ms
120ms Fetch
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com//.status
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept: */*
Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 56ms
55ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305100101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc49f01277b886902586151c2611006fc4b3e24acfc42f7f5e0a4907433ec2f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11266
x-xss-protection: 0

GET
H2 200 loader.js Show response
platform.iteratehq.com/ 1 KB
1 KB 36ms
17ms Script
application/javascript 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/loader.js

Requested by

Host: login2.demonyins.top
URL: https://login2.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
x-amz-version-id: sxbh0sX1Uu_9VWD90bhaukCR16JbmzF2
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: 056YG4AM75SJP6DB
age: 119
x-amz-server-side-encryption: AES256
x-amz-id-2: fZQfSOT22oAaj4/yRGlr2MSZa4E2vk+NrEVMtw8aFUuC60VnxkU5l8rZlipOT5jto/JqSIKsvBE=
last-modified: Wed, 10 May 2023 19:20:45 GMT
server: cloudflare
etag: W/"8c061118fbe1f3981a379fa8bf00aa91"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNUuWqcWZDFh%2BAlFSYB7cEN6Sj1xHaHZe2VKhg%2FVyXngrriA3GhjzRDoxP%2BUN33laGD5DO4tHHNFAASWN45lLWCtJne9fofeC6NMEWSSqlOKfT7JLwiFDnXFiK%2F4Ie0WzT70mhcrFVei%2Bp48UNjDo4UThhM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 7c7d2d048cde3803-FRA

GET
H2

200

cs.js Show response
sb.scorecardresearch.com/internal-c2/3005403/
Redirect Chain

https://sb.scorecardresearch.com/c2/3005403/cs.js
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

0
359 B

7ms
6ms

Script
application/javascript

13.32.99.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/3005403/cs.js
Protocol: H2
Server: 13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-105.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:28:06 GMT
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
last-modified: Mon, 01 Mar 2021 20:41:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 844
x-amz-server-side-encryption: AES256
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 0
x-amz-cf-id: 234O9n7-sEby-0zvIoNgAfo6oSAvCcFSzh34lHf6r-Wx6jnR7krSGQ==

Redirect headers

date: Mon, 15 May 2023 17:42:09 GMT
via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
location: /internal-c2/3005403/cs.js
content-length: 0
x-amz-cf-id: pWJbB61Is16g7Lw6AgMOcDsr0Wuph2fbq_0EdWWECHCC9jTVHaJG0Q==

GET
H2 200 match-prod-2ba9e5cdc9d92a535fcf.js Show response
platform.iteratehq.com/ 85 KB
30 KB 17ms
17ms Script
application/javascript 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
x-amz-version-id: b33MITr7SVI4DDhNP4LfAri2wMAOFhLe
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: XC4D2T4SR9M4PNJA
age: 426002
x-amz-server-side-encryption: AES256
x-amz-id-2: c4dep+Dnz4ChKoyKo6kFtiEObB/0nrrc25T6zNnamC2jm6hcryptB1k3y+fD4/pwr6/WjZAebkk=
last-modified: Wed, 10 May 2023 19:20:43 GMT
server: cloudflare
etag: W/"74caba77682b49745a5ab63f20fc5cde"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eH8Qie%2FAfsSdJAcGA%2FU2kb2LvWlJjzuA%2FRS5dGoRy3ING6RNJbgwzIz84%2FfjYwaySr5Hfajle4TOO1pFbv77ljwJe7BOC45W1gcWXc7IMOPEfFBWI1w4TcCTmanj0HaIRXn8xWn7wLz4rsiWSBHXGpHxfz0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7c7d2d04ad113803-FRA

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 17:42:09 GMT

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 123ms
104ms Preflight 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login2.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d2d04fdd09052-FRA
content-length: 0
date: Mon, 15 May 2023 17:42:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bJg6z%2Fld8ptjOsYUFkdIl%2F%2BPMsI2oRpGzyvQni7lg0uKLJn7AiNdQQA0x%2BSUkFQru%2BGkshebUYnjv7bwCxXv0OI3SU150X%2BTitdNSvKCwnRqbOxOADexTWtw%2FlqM8OnWdnY0QdZDtZq5xmg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 300 B
552 B 107ms
107ms Fetch
application/json 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e95cefca4671568895783473ff82a52ea2d56151927c44c6584af8bc3b7bfae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNTQ0MTI5MzQxfQ.UI13nEXGs0udbZxhjyFLruAEed42XwFO4fZlCqOgY1o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MAkn7hzFFIv4NiGwitHQAC%2FnH3zMvUP7FoNi6R0lv3Ndloyg6Tmf0RHAgai3h7XTuQ%2FFAzyGHSYjk%2FT2eKpfubhxx%2BZHHxVqKKzTOtiWwJsx17IHKl7VAlJpxi5%2Bo6exQWWIJ%2BL2vuw0vS4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d2d059e819052-FRA

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame DB4E 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login2.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11855
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 14:24:34 GMT
expires: Tue, 14 May 2024 14:24:34 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7D57 783 B
1 KB 38ms
17ms Document
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a7a55caa3063d6efa8eab3bae21bc4420be996736ecf65e6eaabac3cc2a3dbb5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dn8rUhAUxsCaKDXz-rwOJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login2.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-dn8rUhAUxsCaKDXz-rwOJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:42:09 GMT
expires: Mon, 15 May 2023 17:42:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 08cn5b8EVMSc5l6e1YWDk0jg24yFrQ2cZ845B_qPECM.js Show response
pagead2.googlesyndication.com/bg/ Frame DB4E 37 KB
14 KB 23ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/08cn5b8EVMSc5l6e1YWDk0jg24yFrQ2cZ845B_qPECM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3c727e5bf0454c49ce65e9ed585839348e0db8c85ad0d9c67ce3907fa8f1023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 11:44:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14732
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 May 2024 11:44:57 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7D57 0
0 108ms
107ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305100101&jk=642039890918288&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame DB4E 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?NFJoig
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 pd
u.openx.net/w/1.0/ 43 B
131 B 36ms
16ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:42:09 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sync
eb2.3lift.com/ 37 B
140 B 36ms
8ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/sync?px=1&src=prebid&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:09 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H/1.1 200
OK cksync.php
cs.media.net/ 60 B
426 B 61ms
28ms Image
image/gif 23.212.88.20
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.88.20 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-88-20.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:42:09 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 60
x-mnet-hl2: E
Expires: Mon, 15 May 2023 17:42:09 GMT

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 64 B
349 B 102ms
100ms Fetch
application/json 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmVmMTkxY2M3MjAwMDEwMmRhZGEiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNTI5fQ.aw4Xr69i6eZYbcFGJtYVAryHK09jGNZS64UVtci-oxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:42:10 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DPHLbuCBJEa9xpz%2BR%2FzfCzVdvIvCctDWFFZbbHSOf7ZNeOzJDj6BhfRqoXjI07dFDDKuxZdgjk2w4KzH4aGabkSYpjzzOVBGbFDd6vliWoalQIubb6OntMBHHyHE7%2BGhEXZw8bB%2FNOKGQR0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d2d08aa239052-FRA

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 108ms
108ms Preflight 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login2.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d2d07f9649052-FRA
content-length: 0
date: Mon, 15 May 2023 17:42:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BiLmVtev2pUAZvpz%2BFmlOPi%2FwW7NkD3E%2BJhfKnyYof2WyzAWE7%2BNt6vlYow%2B3ZgyaywsY2Fp2u4xrqxaWBTD0oWipwU7sheVzHSuOs8QveC7fmrYtU4P4YtGzZSfdTqOot7dMmNehxLFcc8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 114ms
114ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305100101&jk=642039890918288&bg=!UFOlUwfNAAYldGN0BXQ7ADkAdvg8Wi90M0he_pEf7gu9GgYllpFNesgQKKaZ3F0WoIPjvuKDWoVr4CESe1NIHnc8yaxKMKa9cskCAAAAU1IAAAACaAEHmQKyk0OYx3x4IBFnOqXWLZ9UH6slRqOSyTSsK-Vvhy_m30zAiwUSW1pE5Jp5lD7eLLvzyX8Ih5E-oeWERiCApq9_7mJh7Q7WXZo7pdqtba1VLYMKE6SoWz0qasT3b7M-xADzuGZ_QtwEUj8BrBiCoALT-cnYZHq2OC0tnGAezMvhrZlDDd1gUwGMuBeMSz6Muk5No2WSvb351IcOHhZzHImI5SlWeecyfwBaKaY2oiQymiDP_GV0pdTBVirgQF8jBnPtOJsar5Sy_Bf9dlLWipmh8uJa11RsYzeu2TP893vKyruOKcu9gdSGavTWlLSIfW9MUzttDi12F5n004QF470n80TYMsN3jrWHDA4cBc_OQmkODNElkxuO1nMz4mIasud1XAhSnDTywv9QRJUmboZ8tc4HpevzZOhUg0CCWPuEr2jJ6YtWIcpqyiH1DDNMItiVd4Cn6CdzN5gE1cmI5Fm91-1N0AMWCNrHCoCdBnHMnwsq8wVboJh7akZSb2hB4teJjnfsRMTmgIM9MF2j2DXW95Rx9yHjY3zdVzuje6RVzn77KrewPHQwSH9ht1Dy2GrmibBOQ3mS8Nkipw30zEoY02eJrQwRQQyb9suCJW3f2JCnv4kZA5GaTe0n5lJDa6LLEw7_5eZjDsS_0Q8cH2qsm_VnLcD_lLfcB3Fpp1eifq1uMaP3b0lFGfGWup6JUXw0wdWpOFTGX79j8pmzyDIb0X99qdc1RVsTD0IfoN76v2Rv0eypXyjsHIgBmWBq1EsxNiYtsyyURzqDEZYtZix71IguXYutyx85v_K_lXaUc2RwiVK1Soq60IiK5O2LhTgabaeQnM65y3P0VFcgkdvb2kiv7z7ZD77UD_U8ZHJIS9Xr0LPAk8ra2mKa7lmQZlAStvJ6p0I3tSSHh_-QyF0gjcjP
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login2.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H2 200 track
a.et.nytimes.com/ 0
0 120ms
119ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login2.demonyins.top
URL: https://login2.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login2.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: als-svc.nytimes.com
URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: purr.nytimes.com
URL: https://purr.nytimes.com/v1/purr-cache

Domain: a.nytimes.com
URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172528295&referrer=&sourceApp=nyt-vi

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: meter-svc.nytimes.com
URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin2.demonyins.top%2F&referer=https%3A%2F%2Flogin2.demonyins.top%2F&pageviewID=IvTRy1k01IMK10WgjGPdJEF4

Verdicts & Comments Add Verdict or Comment

133 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.nytimes.com/	1970-01-20 20:35:08	Name: nyt-a Value: AYFlU2TG_RuYM6VTYkerxGgV
.et.nytimes.com/	1970-01-20 11:49:34	Name: sessionActive Value: true
.et.nytimes.com/	1970-01-20 20:35:08	Name: sessionIndex Value: 1\|1684172525997\|AYFlU2TG_RuYM6VTYkerxGgV\|1684172525997
.et.nytimes.com/	1970-01-20 11:50:58	Name: et-ppvid Value: https://login2.demonyins.top/=IvTRy1k01IMK10WgjGPdJEF4
.rubiconproject.com/	1970-01-20 20:35:08	Name: khaos Value: LHP4U6CN-M-3N4O
.rubiconproject.com/	1970-01-20 20:35:08	Name: audit Value: 1\|naVuGyos1qpxJ6jJpAzdpHjc0/aJelRdbjRFtGIHH0vAwlOVW3UfWLkxqnOvs9Z7NHyDmjHQXtVcMp/y83GRUqTN5wtz4/dyGeuTp7YJsxQbsm1clVNMrQ==
.demonyins.top/	1970-01-20 21:11:08	Name: __gads Value: ID=a9e29a1ffc14fe7e:T=1684172526:S=ALNI_MYKXwvXfqlH0pTpXJu_2GsfuQcGTg
.demonyins.top/	1970-01-20 21:11:08	Name: __gpi Value: UID=00000c15c47eae01:T=1684172526:RT=1684172526:S=ALNI_MZJAOb7_HMdIQzu-MZqHEQVcvowrA
.doubleclick.net/	1970-01-20 21:11:08	Name: IDE Value: AHWqTUkC2y4FCzyIyhNz0KZpW81V6w8O6aDMVtkRWnCfs1wvBU7CwucM-i9A6j2H63k
.login2.demonyins.top/	1970-01-20 20:35:08	Name: datadome Value: 3GKWMQTgo7mLsws5dj9Ivs-TcOUXlr974LRBe1_cyahmUuGJiaGtleT-mFr1YKdFQ-y5RHUabCWop0du~2zL9NN1LbwMH1YI2jPvel8g3py8uKZPakZXxVMMUYK4~nHr
.demonyins.top/	1970-01-20 13:59:08	Name: _gcl_au Value: 1.1.1583729849.1684172529
.demonyins.top/	1970-01-20 21:25:32	Name: walley Value: GA1.2.2019307107.1684172526
.demonyins.top/	1970-01-20 11:50:58	Name: walley_gid Value: GA1.2.1764503220.1684172529
.demonyins.top/	1970-01-20 11:49:32	Name: _gat_UA-58630905-7 Value: 1
.demonyins.top/	1970-01-20 21:18:20	Name: _cb Value: BMmH-kCx7WH2D5kzbM
.demonyins.top/	1970-01-20 21:18:20	Name: _chartbeat2 Value: .1684172528880.1684172528880.1.DbTn6kD8-fz1VobixD3d7eRBUye4S.1
.demonyins.top/	1970-01-20 11:49:34	Name: _cb_svref Value: null
.demonyins.top/	1970-01-20 21:25:32	Name: iter_id Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmVmMTkxY2M3MjAwMDEwMmRhZGEiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNTI5fQ.aw4Xr69i6eZYbcFGJtYVAryHK09jGNZS64UVtci-oxw

19 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ads Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login2.demonyins.top').
security	error	URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login2.demonyins.top').
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172528295&referrer=&sourceApp=nyt-vi' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172528295&referrer=&sourceApp=nyt-vi Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login2.demonyins.top/ Message: Access to fetch at 'https://purr.nytimes.com/v1/purr-cache' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://purr.nytimes.com/v1/purr-cache Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login2.demonyins.top/ Message: Access to XMLHttpRequest at 'https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin2.demonyins.top%2F&referer=https%3A%2F%2Flogin2.demonyins.top%2F&pageviewID=IvTRy1k01IMK10WgjGPdJEF4' from origin 'https://login2.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin2.demonyins.top%2F&referer=https%3A%2F%2Flogin2.demonyins.top%2F&pageviewID=IvTRy1k01IMK10WgjGPdJEF4 Message: Failed to load resource: net::ERR_FAILED
security	error	URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login2.demonyins.top').
security	error	URL: https://5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login2.demonyins.top').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5290727.fls.doubleclick.net
5da7d69f5c57a2e2677099d8d20fdf6d.safeframe.googlesyndication.com
a.et.nytimes.com
a.nytimes.com
a1.nyt.com
aax.amazon-adsystem.com
adservice.google.com
adservice.google.de
als-svc.nytimes.com
c.amazon-adsystem.com
cdn.brandmetrics.com
collector.brandmetrics.com
cs.media.net
dd.nytimes.com
eb2.3lift.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g1.nyt.com
ib.adnxs.com
iteratehq.com
login2.demonyins.top
meter-svc.nytimes.com
nytimes-d.openx.net
pagead2.googlesyndication.com
platform.iteratehq.com
pnytimes.chartbeat.net
prebid.media.net
purr.nytimes.com
rumcdn.geoedge.be
samizdat-graphql.nytimes.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.chartbeat.com
static01.nyt.com
static01.nytimes.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
vp.nyt.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.nytimes.com
a.nytimes.com
als-svc.nytimes.com
meter-svc.nytimes.com
purr.nytimes.com
samizdat-graphql.nytimes.com
13.248.245.213
13.32.99.105
142.250.186.166
143.204.215.97
151.101.65.164
18.196.86.54
20.50.2.28
23.212.88.20
2600:9000:2057:6000:18:1fcd:351:7bc1
2600:9000:2491:1600:4:b37b:9440:93a1
2602:803:c003:200::51
2606:4700:20::681a:7e5
2606:4700:20::ac43:4842
2606:4700:3031::ac43:d8c7
2a00:1450:4001:806::2002
2a00:1450:4001:806::2008
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:827::200a
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2004
2a00:1450:4001:82f::200e
2a00:1450:4001:830::2001
2a00:1450:4001:831::2001
34.107.148.139
34.98.64.218
37.252.171.149
44.211.112.71
52.222.208.154
52.222.239.116
54.165.163.91
03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de
0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f
0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16
10b02bf3ec4575faaa1dda7a1ef9a2ecce233df0bf36e6467f5458ef45e23618
111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063
173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9
2cc6cfc6f07bc4cef11c2dee27ca861146085b4aeb618527bef97c9e2a1c54ce
2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067
34c6dd7ed31bcefc95f660e8d64b202109f11fe010ae808b188f11623b8f6ca1
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
49d1147cb46ca2675c657b6e71544ef443bfe5d8b51552277a9c7b481d04f553
4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3
519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de
57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176
5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418
5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0
6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
640a9138e66deb5b745997e8dbe0be6e4c32d82da5710f9cea8afb0bee2f3bbf
66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec
6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65
72ebd562aa447fc1117146bea7c5e7bc1d76fdb3f17d3e809e77bca9ea715a5d
73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e
75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b
766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f
7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14
7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47
8077ba7f17c4f87be60472add569ee1c02846793a8c019ebf77d236e024570ab
8658fc44ca45cf40ee56d54bccb269e8cbca4ad85f1ea1bfbbc5faf127a7dec3
88011d782fa21da0ec301e49080fa9950973db277a33674d252f0fe1e333f61f
88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306
8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad
8cfb0ab8d7f169f0fc590e4c6da6a0c7e990fc1242e674068bf5af06a9f8b0b3
8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48
8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73
9543af1948131405c8094ce36e58c26be9a33ef4117644937081188b31a178c1
97b9ca613f6d6854860aaf524d0dae463f58162d0e2db845d78713993c2b3370
98a3ab26574717a95d200c12658c4dbbb28109a057cc52f8a100e6da2b645963
9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47
a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f
a3bfb92d43190843562798ecf3be33e1c0681aba24625e7357a27a588ae09d8e
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4
a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73
a7a55caa3063d6efa8eab3bae21bc4420be996736ecf65e6eaabac3cc2a3dbb5
a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502
ab011b127403d86c7e7e9ab59ee46278c99dfbd943a2e7bd1f068177d8961c13
b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b
b3fbd953664215264e3a7fb2c2c68a3826fe96c5801ffe3d79ad431cfb37b78a
b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c4086733e752502e3527667e254f21490106433ea24b95b163ac3e32c3e75388
c4591eed27abff378652a507923552094808684c88965a1f19a163b684b6616e
c9fb083529541e219ad17a00cb201b3dba9dabcdcc01eae4eb9ac04b8cb72216
ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07
cd537ad544dec1bbf725941a8134683bf3ffdb4bc5ce64f9db41197e96447ebe
cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da
cf39605b08318630a6d3a15b4ba3974185951acfac5ce7c94025bfae500ae604
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d00cbd77067ec5e17df26c2bab2bb050ab6e0518598826993f80f5c68b67de24
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d339d9d854cbf06c598e32f1c2a6e9eadf831caea453a47dcf1405695e826a8e
d3c727e5bf0454c49ce65e9ed585839348e0db8c85ad0d9c67ce3907fa8f1023
d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4
d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3
d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89
d85711c9a360bc75ca701f1a12e6716f1d0e29df71130cd033c38d2b93cf36ef
d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519
e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e95cefca4671568895783473ff82a52ea2d56151927c44c6584af8bc3b7bfae1
ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9
ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9
ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3e707799c4b8c1017aaed1c78432af2cc213ea88229312c1b2d621aa0ade9ef
f4c26865119bbda5a61aeb17d0112d12d1c2e4b856fae82debad19c4b5ff7d84
f514b08fb7d5209344628ea9664fd4d59a79c6060c0f8be77ac68e85a9d5ceec
f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87
f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe
f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb
f8673a6ef5346b440f71cdd7bca37da0ece0e6290f03e0c9bb9d62297401c3ba
fa5db2ca049f83b8cd3f155021ef79de17b9ab65488141adc4888dcfd36f9d05
fc49f01277b886902586151c2611006fc4b3e24acfc42f7f5e0a4907433ec2f9
fe2348e120483e7fcac0533cbda1afc12e5aac50c30a1fffe3eac158e8a5c5ee
fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3
fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

login2.demonyins.top Open in urlscan Pro 2606:4700:3031::ac43:d8c7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

133 Requests

94 %HTTPS

55 %IPv6

24 Domains

45 Subdomains

34 IPs

3 Countries

3598 kBTransfer

7822 kBSize

18 Cookies

80 Outgoing links

Redirected requests

133 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

login2.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Screenshot
Live screenshot

Full Image

133
Requests

94 %
HTTPS

55 %
IPv6

24
Domains

45
Subdomains

34
IPs

3
Countries

3598 kB
Transfer

7822 kB
Size

18
Cookies

133 HTTP transactions
2 data transactions