urlscan.io logo urlscan.io
SecurityTrails logo

offshoreleaks.icij.org Open in urlscan Pro
13.226.159.99  Public Scan

Go To Rescan Add Verdict Report
URL: https://offshoreleaks.icij.org/nodes/10105499
Submission: On April 06 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 10 domains to perform 31 HTTP transactions. The main IP is 13.226.159.99, located in United States and belongs to AMAZON-02, US. The main domain is offshoreleaks.icij.org.
TLS certificate: Issued by Amazon on August 10th 2020. Valid for: a year.
This is the only time offshoreleaks.icij.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

8    13.226.159.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-99.dus51.r.cloudfront.net
offshoreleaks.icij.org
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
4    2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
2    2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
3    104.111.238.139 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-139.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
4    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2600:9000:2182:a200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
2    2a00:1450:400c:c0b::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
Domain Requested by
8 offshoreleaks.icij.org offshoreleaks.icij.org
5 fonts.gstatic.com fonts.googleapis.com
5 www.google-analytics.com offshoreleaks.icij.org
www.google-analytics.com
3 sb.scorecardresearch.com 1 redirects offshoreleaks.icij.org
2 stats.g.doubleclick.net www.google-analytics.com
2 maxcdn.bootstrapcdn.com offshoreleaks.icij.org
maxcdn.bootstrapcdn.com
1 pixel.quantserve.com offshoreleaks.icij.org
1 rules.quantcount.com secure.quantserve.com
1 secure.quantserve.com offshoreleaks.icij.org
1 fonts.googleapis.com offshoreleaks.icij.org
0 r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net Failed
31 11
Subject Issuer Validity Valid
*.icij.org
Amazon		 2020-08-10 -
2021-09-09		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA		 2020-10-02 -
2021-10-07		 a year crt.sh
sb.scorecardresearch.com
DigiCert Secure Site ECC CA-1		 2020-07-17 -
2021-06-02		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://offshoreleaks.icij.org/nodes/10105499
Frame ID: EC37BC5C1487E6217D978DF3FD9CCCCE
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i

Page Statistics

31
Requests

90 %
HTTPS

83 %
IPv6

10
Domains

11
Subdomains

13
IPs

3
Countries

669 kB
Transfer

1267 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23
  • https://sb.scorecardresearch.com/b?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&c9=&cs_ak_ss=1
Request Chain 30
  • https://a248.e.akamai.net/chartbeat.download.akamai.com/102508/js/chartbeat.js HTTP 302
  • https://r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net/.36898.1602645843.659199./102508/js/chartbeat.js

31 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 10105499
offshoreleaks.icij.org/nodes/ 		41 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
334893eccffc69955b09fc539cb4317b74ac9b0863d2fdbab9dec51410eb1042
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options ALLOWALL

Request headers

:method
GET
:authority
offshoreleaks.icij.org
:scheme
https
:path
/nodes/10105499
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 06 Apr 2021 07:24:23 GMT
status
200 OK
cache-control
max-age=0, private, must-revalidate
etag
W/"0ec89dcf9635f252b23470a475ef79e5"
x-frame-options
ALLOWALL
x-runtime
0.010676
x-request-id
239E884D_F252_AC14809C_01BB_606C0CA6_6514AD_12A149
strict-transport-security
max-age=31536000
content-encoding
gzip
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
JH6eqVKugKdcWTOhBwu2qQ2PL0yLmn1rne6CIollnCel1aEqpOLiBA==
age
458
application-2249b09ef52b76932b545cc378ba64f3ac099540c7839c30dee7beb30424b612.css
offshoreleaks.icij.org/assets/ 		97 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://offshoreleaks.icij.org/assets/application-2249b09ef52b76932b545cc378ba64f3ac099540c7839c30dee7beb30424b612.css
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
d9e2c8495514dc7b23deac0d6886133e19558d4c5ab4be0c02bd1a071246b509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:26:31 GMT
content-encoding
gzip
age
331
vary
Accept-Encoding
strict-transport-security
max-age=31536000
content-type
text/css
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
cache-control
max-age=315360000, public
x-cache
Hit from cloudfront
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
m91LdSebJbsvE7luTf36ZAapDRL1t6wwBHAlGU0jWx-S6qgBjTreXA==
x-request-id
40FC5877_3692_AC14809C_01BB_606C0D23_63DFC5_12A148
expires
Thu, 31 Dec 2037 23:55:55 GMT
application-d854fc65839705328f68bf3d656f2e4f7edfa61c78672a75babcce5085496957.js
offshoreleaks.icij.org/assets/ 		619 KB
210 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://offshoreleaks.icij.org/assets/application-d854fc65839705328f68bf3d656f2e4f7edfa61c78672a75babcce5085496957.js
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
d854fc65839705328f68bf3d656f2e4f7edfa61c78672a75babcce5085496957
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:25:03 GMT
content-encoding
gzip
age
419
vary
Accept-Encoding
strict-transport-security
max-age=31536000
content-type
application/javascript
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
cache-control
max-age=315360000, public
x-cache
Hit from cloudfront
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
P3zJJfYk2Wa-dVcXV8m-5oZJGHMXhL-6ErzvOpPAK9BluTdpHyhPxA==
x-request-id
3439FEF4_F2E8_AC14809C_01BB_606C0CCF_65174D_12A149
expires
Thu, 31 Dec 2037 23:55:55 GMT
Logo-77b6130fd0fd70a9cc72a6ab68bb05fe7035076132099bbdeea79ab88321f21a.svg
offshoreleaks.icij.org/assets/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offshoreleaks.icij.org/assets/Logo-77b6130fd0fd70a9cc72a6ab68bb05fe7035076132099bbdeea79ab88321f21a.svg
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
77b6130fd0fd70a9cc72a6ab68bb05fe7035076132099bbdeea79ab88321f21a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:25:03 GMT
content-encoding
gzip
age
419
vary
Accept-Encoding
strict-transport-security
max-age=31536000
content-type
image/svg+xml
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
cache-control
max-age=315360000, public
x-cache
Hit from cloudfront
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
et6nvN63pD9szd7uTinBrnCUOfJBH2VFpDf5zegP1aM2t4uFbEjLUA==
x-request-id
3439FEF4_F2D2_AC14809C_01BB_606C0CCF_65174A_12A149
expires
Thu, 31 Dec 2037 23:55:55 GMT
pieces_whoiswho-469a34fc5b5ca6774140c219837b2f1973ac1ab63ddb000c8729315e3d6d0c62.png
offshoreleaks.icij.org/assets/ 		144 KB
144 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offshoreleaks.icij.org/assets/pieces_whoiswho-469a34fc5b5ca6774140c219837b2f1973ac1ab63ddb000c8729315e3d6d0c62.png
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
469a34fc5b5ca6774140c219837b2f1973ac1ab63ddb000c8729315e3d6d0c62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:25:03 GMT
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
age
418
strict-transport-security
max-age=31536000
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=315360000, public
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
content-length
147310
x-amz-cf-id
eBnbSClL9tRX7CHFqfVZu7uwaV7qD3AepdL8lNhPfKI4FjGp_-6WXA==
x-request-id
3439FEF4_F2D6_AC14809C_01BB_606C0CCF_65174C_12A149
expires
Thu, 31 Dec 2037 23:55:55 GMT
opencorporates-8f60ea27ed7dfa3af9e8fc17f663a5fb8298cff0f5b1dc6034f38d011ddc21a6.png
offshoreleaks.icij.org/assets/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offshoreleaks.icij.org/assets/opencorporates-8f60ea27ed7dfa3af9e8fc17f663a5fb8298cff0f5b1dc6034f38d011ddc21a6.png
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
8f60ea27ed7dfa3af9e8fc17f663a5fb8298cff0f5b1dc6034f38d011ddc21a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:29:05 GMT
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
age
176
strict-transport-security
max-age=31536000
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=315360000, public
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
content-length
4103
x-amz-cf-id
AG7U6TagyxWKpdECSL3z30QJmxlTbB_8pVaevypD56o2h5Tjmg3tdg==
x-request-id
239E884D_3818_AC14809C_01BB_606C0DC1_65263A_12A149
expires
Thu, 31 Dec 2037 23:55:55 GMT
spinner-6847b2b59ba6f3a30775291a4a8170b7e5909494e158b25f05c788e5952f5003.gif
offshoreleaks.icij.org/assets/ 		59 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offshoreleaks.icij.org/assets/spinner-6847b2b59ba6f3a30775291a4a8170b7e5909494e158b25f05c788e5952f5003.gif
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
6847b2b59ba6f3a30775291a4a8170b7e5909494e158b25f05c788e5952f5003
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:25:31 GMT
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
age
391
strict-transport-security
max-age=31536000
x-cache
Hit from cloudfront
content-type
image/gif
cache-control
max-age=315360000, public
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
content-length
60107
x-amz-cf-id
BxmDMhracf7L_2BCiiHDFvvHQVYA7spxoPssqfEYa5hqwtg02AHgyA==
x-request-id
239E884D_4770_AC14809C_01BB_606C0CEB_63DC79_12A148
expires
Thu, 31 Dec 2037 23:55:55 GMT
css
fonts.googleapis.com/ 		7 KB
819 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/assets/application-2249b09ef52b76932b545cc378ba64f3ac099540c7839c30dee7beb30424b612.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cf6aa7aae4655a089541ac3bd5ebf59cf261e220dac5944383c433061d25561d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Apr 2021 07:25:07 GMT
server
ESF
date
Tue, 06 Apr 2021 07:32:02 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Apr 2021 07:32:02 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 		28 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/assets/application-2249b09ef52b76932b545cc378ba64f3ac099540c7839c30dee7beb30424b612.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:32:02 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
722, 617
age
2289868
cdn-cachedat
2021-03-10 20:26:25
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0947b185a70000c2815c226000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
9ea34949095d43cdb6f22ce94bc7b665
cf-ray
63b951e90c15c281-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
analytics.js
www.google-analytics.com/ 		48 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/assets/application-d854fc65839705328f68bf3d656f2e4f7edfa61c78672a75babcce5085496957.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
last-modified
Fri, 19 Mar 2021 19:22:18 GMT
server
Golfe2
date
Tue, 06 Apr 2021 07:32:02 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17432
expires
Tue, 06 Apr 2021 09:32:02 GMT
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v17/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 01 Apr 2021 04:06:34 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:46 GMT
server
sffe
age
444328
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23484
x-xss-protection
0
expires
Fri, 01 Apr 2022 04:06:34 GMT
S6u9w4BMUTPHh50XSwiPGQ.woff2
fonts.gstatic.com/s/lato/v17/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 02 Apr 2021 10:03:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:30 GMT
server
sffe
age
336505
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22572
x-xss-protection
0
expires
Sat, 02 Apr 2022 10:03:37 GMT
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v17/ 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 02 Apr 2021 10:03:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:12:12 GMT
server
sffe
age
336505
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22992
x-xss-protection
0
expires
Sat, 02 Apr 2022 10:03:37 GMT
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/ 		69 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:32:02 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617
age
2289346
cdn-cachedat
2021-03-10 20:26:26
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
70728
cf-request-id
0947b185f800000631b61eb000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
1e2797b4a15db1d5a3a50a0dc46a9f16
accept-ranges
bytes
cf-ray
63b951e9887f0631-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
quant.js
secure.quantserve.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
16d7d7227f6d8251224d32cd45c81633a3a9d63bf35cd84b1d99d389becb5030

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:32:02 GMT
content-encoding
gzip
etag
"YoFsxqR3BwPygbSjh02Dug=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Tue, 13 Apr 2021 07:32:02 GMT
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.238.139 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-139.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 06 Apr 2021 07:32:02 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
884
Expires
Wed, 07 Apr 2021 07:32:02 GMT
u-440qyriQwlOrhSvowK_l5-fCZM.woff2
fonts.gstatic.com/s/merriweather/v22/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZM.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e19e5fec549d0d871301c8196f4a954abe8d6913464a1ac511f81ef71529f89b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 30 Mar 2021 13:38:29 GMT
x-content-type-options
nosniff
last-modified
Thu, 10 Sep 2020 17:09:53 GMT
server
sffe
age
582813
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19300
x-xss-protection
0
expires
Wed, 30 Mar 2022 13:38:29 GMT
u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
fonts.gstatic.com/s/merriweather/v22/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,900|Merriweather:400,700,900&subset=latin-ext
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a0d93254e392f7361b334641f8781721fd31c7b18283c88fe67df7d3123e1c24
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://offshoreleaks.icij.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 03 Apr 2021 06:30:47 GMT
x-content-type-options
nosniff
last-modified
Thu, 10 Sep 2020 17:08:44 GMT
server
sffe
age
262875
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18924
x-xss-protection
0
expires
Sun, 03 Apr 2022 06:30:47 GMT
linkurious-favicon-16x16.png
offshoreleaks.icij.org/ 		392 B
760 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://offshoreleaks.icij.org/linkurious-favicon-16x16.png
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-99.dus51.r.cloudfront.net
Software
/
Resource Hash
4c0c455d1e1e3ce12c2eb41dd650be7d547ce09a5c734ae9c3a29048c2360d9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://offshoreleaks.icij.org/nodes/10105499
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
last-modified
Wed, 02 Sep 2020 10:16:49 GMT
x-amz-cf-pop
DUS51-C1
etag
"5f4f7111-188"
x-cache
Hit from cloudfront
content-type
image/png
date
Tue, 06 Apr 2021 07:32:02 GMT
accept-ranges
bytes
content-length
392
x-amz-cf-id
fU0Hue3X4oeX_dec8qVaPcXeKZUCQ8_yotpwwi1ZhUJexBfa4bctNw==
x-request-id
3439FEF4_AA2C_AC14809C_01BB_606A790A_4FA993_12A148
truncated
/ 		928 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
218b6546e5d2bf4b0aa005d0292436b41a51e7f9e3670b4ae7a4f759534c39f1

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
659fb6eb-69c8-4f43-b304-7246a7a7db6f
https://offshoreleaks.icij.org/ 		8 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://offshoreleaks.icij.org/659fb6eb-69c8-4f43-b304-7246a7a7db6f
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e95da5b08f0b510fd427641ccfeedc9580de2dc05e7c414f824fc5fdcd7656b6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
8314
Content-Type
application/javascript
32de6d00-d033-4a2d-bc42-774dc985b8a1
https://offshoreleaks.icij.org/ 		8 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://offshoreleaks.icij.org/32de6d00-d033-4a2d-bc42-774dc985b8a1
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e95da5b08f0b510fd427641ccfeedc9580de2dc05e7c414f824fc5fdcd7656b6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
8314
Content-Type
application/javascript
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
990 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:24:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
463
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 06 Apr 2021 08:24:19 GMT
rules-p-b6kuKY3_qNPmQ.js
rules.quantcount.com/ 		3 B
357 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-b6kuKY3_qNPmQ.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:a200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 06:20:12 GMT
via
1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront)
last-modified
Sat, 04 Mar 2017 20:49:46 GMT
server
AmazonS3
age
11262
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Hit from cloudfront
content-type
application/x-javascript
cache-control
max-age=86400
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
content-length
3
x-amz-cf-id
_4Dkl2kyMAcie27YH8zao8D12eSc3JUhymBhEPmSX6y6ExcS9AkrpQ==
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks.i...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks....
0
399 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&c9=&cs_ak_ss=1
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.238.139 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-139.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 06 Apr 2021 07:32:02 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=18176538&ns__t=1617694322450&ns_c=UTF-8&cv=3.5&c8=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&c7=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&c9=&cs_ak_ss=1
Pragma
no-cache
Date
Tue, 06 Apr 2021 07:32:02 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
ec.js
www.google-analytics.com/plugins/ua/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 06 Apr 2021 07:24:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
463
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Tue, 06 Apr 2021 08:24:19 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-3383794-9&cid=1850026391.1617694322&jid=458081782&gjid=856244757&_gid=1088392501.1617694322&_u=aHDAiEIpBAAAAE~&z=922966590
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 06 Apr 2021 07:32:02 GMT
content-type
text/plain
access-control-allow-origin
https://offshoreleaks.icij.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
67 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-3383794-10&cid=1850026391.1617694322&jid=593255006&gjid=394875679&_gid=1088392501.1617694322&_u=aHDAiEIpBAAAAE~&z=1507815897
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 06 Apr 2021 07:32:02 GMT
content-type
text/plain
access-control-allow-origin
https://offshoreleaks.icij.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j89&a=586765593&t=pageview&_s=1&dl=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&ul=en-us&de=UTF-8&dt=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAiEIpB~&jid=458081782&gjid=856244757&cid=1850026391.1617694322&tid=UA-3383794-9&_gid=1088392501.1617694322&cd1=ICIJ&cd2=Offshore%20Leaks%20Database&z=1333155211
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Apr 2021 10:03:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77305
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j89&a=586765593&t=pageview&_s=1&dl=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499&ul=en-us&de=UTF-8&dt=EARDLEY%20ENTERPRISES%20S.A.%20%7C%20ICIJ%20Offshore%20Leaks%20Database&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAiEIpBAAAAE~&jid=593255006&gjid=394875679&cid=1850026391.1617694322&tid=UA-3383794-10&_gid=1088392501.1617694322&cd1=ICIJ&cd2=Offshore%20Leaks%20Database&z=1607652730
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Apr 2021 10:03:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77305
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
pixel;r=569731440;labels=ICIJ.Offshore.App;rf=0;a=p-b6kuKY3_qNPmQ;url=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499;uht=2;fpan=1;fpa=P0-1726327310-1617694322505;ns=0;ce=1;qjs=1;qv=e576aef...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=569731440;labels=ICIJ.Offshore.App;rf=0;a=p-b6kuKY3_qNPmQ;url=https%3A%2F%2Foffshoreleaks.icij.org%2Fnodes%2F10105499;uht=2;fpan=1;fpa=P0-1726327310-1617694322505;ns=0;ce=1;qjs=1;qv=e576aef5-20210317211205;cm=;gdpr=0;ref=;d=icij.org;je=0;sr=1600x1200x24;dst=1;et=1617694322504;tzo=-120;ogl=type.article%2Curl.https%3A%2F%2Foffshoreleaks%252Eicij%252Eorg%2Fnodes%2F10105499%2Cimage.https%3A%2F%2Foffshoreleaks%252Ecloud%252Eicij%252Eorg%2Fassets%2Foffshoreleaks_db-59bfc5c3ca76a7c53c1%2Cdescription.Panama%20Papers%20Entity%3A%20EARDLEY%20ENTERPRISES%20S%252EA%252E
Requested by
Host: offshoreleaks.icij.org
URL: https://offshoreleaks.icij.org/nodes/10105499
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://offshoreleaks.icij.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 06 Apr 2021 07:32:02 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
chartbeat.js
r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net/.36898.1602645843.659199./102508/js/
Redirect Chain
  • https://a248.e.akamai.net/chartbeat.download.akamai.com/102508/js/chartbeat.js
  • https://r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net/.36898.1602645843.659199./102508/js/chartbeat.js
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net
URL
https://r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net/.36898.1602645843.659199./102508/js/chartbeat.js

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| gaCall function| LK function| rebindAll function| show_social_links_footer function| show_temp object| _comscore object| _qevents number| _sf_startpt object| _sf_async_config number| donation_box_time_ms number| min_doc_height_to_suggest_donation_box number| min_scroll_to_show_social_links string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| jQuery1124032496354686529183 function| Cookies object| flight object| Mustache function| sigma object| conrad function| _ function| Vue object| Vuex object| gexf function| loadGraph function| shareContent function| acceptTerms object| lk object| sidebarTimerID object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| new_args function| quantserve function| __qc object| ezt object| _qoptions function| qtrack function| udm_ object| ns_p object| COMSCORE number| _sf_endpt

7 Cookies

Domain/Path Name / Value
offshoreleaks.icij.org/ Name: donate.timebomb.pages
Value: 1
.icij.org/ Name: _gat_icijoffshore
Value: 1
.icij.org/ Name: _gat_unified
Value: 1
.icij.org/ Name: _ga
Value: GA1.2.1850026391.1617694322
.icij.org/ Name: __qca
Value: P0-1726327310-1617694322505
.icij.org/ Name: _gid
Value: GA1.2.1088392501.1617694322
offshoreleaks.icij.org/ Name: signup.modal.pages
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Frame-Options ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
offshoreleaks.icij.org
pixel.quantserve.com
r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net
rules.quantcount.com
sb.scorecardresearch.com
secure.quantserve.com
stats.g.doubleclick.net
www.google-analytics.com
r33729-f-36898.c.1.dsdl.b.stor.lb.akamai.net
104.111.238.139
13.226.159.99
2600:9000:2182:a200:6:44e3:f8c0:93a1
2606:4700::6812:acf
2606:4700::6812:bcf
2620:116:800d:21:51e4:db4b:4436:b305
2a00:1450:4001:800::200e
2a00:1450:4001:808::200a
2a00:1450:4001:810::2003
2a00:1450:4001:811::200e
2a00:1450:4001:827::2003
2a00:1450:400c:c0b::9c
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
16d7d7227f6d8251224d32cd45c81633a3a9d63bf35cd84b1d99d389becb5030
218b6546e5d2bf4b0aa005d0292436b41a51e7f9e3670b4ae7a4f759534c39f1
334893eccffc69955b09fc539cb4317b74ac9b0863d2fdbab9dec51410eb1042
469a34fc5b5ca6774140c219837b2f1973ac1ab63ddb000c8729315e3d6d0c62
4c0c455d1e1e3ce12c2eb41dd650be7d547ce09a5c734ae9c3a29048c2360d9e
6847b2b59ba6f3a30775291a4a8170b7e5909494e158b25f05c788e5952f5003
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
77b6130fd0fd70a9cc72a6ab68bb05fe7035076132099bbdeea79ab88321f21a
7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8f60ea27ed7dfa3af9e8fc17f663a5fb8298cff0f5b1dc6034f38d011ddc21a6
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0d93254e392f7361b334641f8781721fd31c7b18283c88fe67df7d3123e1c24
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf6aa7aae4655a089541ac3bd5ebf59cf261e220dac5944383c433061d25561d
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d854fc65839705328f68bf3d656f2e4f7edfa61c78672a75babcce5085496957
d9e2c8495514dc7b23deac0d6886133e19558d4c5ab4be0c02bd1a071246b509
e19e5fec549d0d871301c8196f4a954abe8d6913464a1ac511f81ef71529f89b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e95da5b08f0b510fd427641ccfeedc9580de2dc05e7c414f824fc5fdcd7656b6
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4