www.heraldbulletin.com Open in urlscan Pro
192.104.182.209  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	451	Primary Request / Show response www.heraldbulletin.com/	5 KB 3 KB	630ms 102ms	Document text/html	192.104.182.209 LEE-ASN
General Check archive.org Show headers Download Go to Full URL https://www.heraldbulletin.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.104.182.209 , United States, ASN10668 (LEE-ASN, US), Reverse DNS cms.us-midwest-1.vip.tn-cloud.net Software / Resource Hash c8975c17d1c96ee87e2cead71ac94942b2cffe95622546ee48e636dbcd7a8287 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 9692 cache-control public, max-age=10 content-encoding gzip content-length 2176 content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Wed, 18 Dec 2024 21:03:06 GMT link <https://bloximages.chicago2.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin referrer-policy strict-origin-when-cross-origin strict-transport-security max-age=31536000 vary X-IPCountry, Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN x-loop 1 x-robots-tag noarchive x-tncms 1.84.0; app16; 0.05s; 1.4M x-ua-compatible IE=edge x-vcache HIT x-xrds-location https://www.heraldbulletin.com/tncms/xrds/ x-xss-protection 1; mode=block
GET H2	200	csrf.js Show response www.heraldbulletin.com/shared-content/art/tncms/api/	940 B 763 B	101ms 101ms	Script application/x-javascript	192.104.182.209 LEE-ASN
General Check archive.org Show headers Download Go to Full URL https://www.heraldbulletin.com/shared-content/art/tncms/api/csrf.js Requested by Host: www.heraldbulletin.com URL: https://www.heraldbulletin.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.104.182.209 , United States, ASN10668 (LEE-ASN, US), Reverse DNS cms.us-midwest-1.vip.tn-cloud.net Software / Resource Hash 9fe769bfc93145d27bc2efa853ca49895d7a44af9c5dd2566c3233b66c9d14b4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.heraldbulletin.com Referer https://www.heraldbulletin.com/ Response headers x-vcache HIT cache-control public, max-age=600 content-encoding gzip service-worker-allowed / etag W/"675afb49-3ac" age 256 accept-ranges bytes content-length 537 date Wed, 18 Dec 2024 23:40:23 GMT last-modified Thu, 12 Dec 2024 15:03:37 GMT content-type application/x-javascript vary Accept-Encoding
GET H2	200	access.3e0b8030b6000aa9a609.js Show response www.heraldbulletin.com/shared-content/art/tncms/api/	71 KB 29 KB	201ms 201ms	Script application/x-javascript	192.104.182.209 LEE-ASN
General Check archive.org Show headers Download Go to Full URL https://www.heraldbulletin.com/shared-content/art/tncms/api/access.3e0b8030b6000aa9a609.js Requested by Host: www.heraldbulletin.com URL: https://www.heraldbulletin.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.104.182.209 , United States, ASN10668 (LEE-ASN, US), Reverse DNS cms.us-midwest-1.vip.tn-cloud.net Software / Resource Hash b07d02c8ede625dd16b97254a7d58fb54d63c5906d0c9390a494998d99d495ba Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.heraldbulletin.com Referer https://www.heraldbulletin.com/ Response headers x-vcache HIT cache-control public, max-age=600 content-encoding gzip service-worker-allowed / etag W/"67214290-11c3d" age 111 accept-ranges bytes content-length 29787 date Wed, 18 Dec 2024 23:42:47 GMT last-modified Tue, 29 Oct 2024 20:16:16 GMT content-type application/x-javascript vary Accept-Encoding
GET H2	200	gtm.js Show response www.googletagmanager.com/	226 KB 79 KB	50ms 28ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N Requested by Host: www.heraldbulletin.com URL: https://www.heraldbulletin.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 07eebb1571d5cf843235a91d89966af8343eed57c26e689111585ba2aae78c07 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Wed, 18 Dec 2024 23:44:39 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 18 Dec 2024 23:44:39 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 18 Dec 2024 21:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 79733 x-xss-protection 0 server Google Tag Manager
GET H2	200	gtm.js Show response www.googletagmanager.com/	220 KB 77 KB	17ms 16ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer&gtm=45He4cc1v72758733za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e1ab9f536e80cb9b49bca8755c8b60f0dad0eca2a4ab06d4ad9a273c07f8e55b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Wed, 18 Dec 2024 23:44:39 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 18 Dec 2024 23:44:39 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 18 Dec 2024 21:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 78411 x-xss-protection 0 server Google Tag Manager
GET H2	200	gtm.js Show response www.googletagmanager.com/	309 KB 86 KB	18ms 18ms	Script application/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer&gtm=45He4cc1v72758733za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e37ef9c864d52cf2b0153d8b0a93b78b5832d336997d077c92acb10f16c2db85 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Wed, 18 Dec 2024 23:44:39 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 18 Dec 2024 23:44:39 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Wed, 18 Dec 2024 21:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 88228 x-xss-protection 0 server Google Tag Manager
GET H2	451	/ Show response www.heraldbulletin.com/tncms/csrf/token/	523 B 871 B	113ms 113ms	Fetch text/html	192.104.182.209 LEE-ASN
General Check archive.org Show headers Download Go to Full URL https://www.heraldbulletin.com/tncms/csrf/token/ Requested by Host: www.heraldbulletin.com URL: https://www.heraldbulletin.com/shared-content/art/tncms/api/csrf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.104.182.209 , United States, ASN10668 (LEE-ASN, US), Reverse DNS cms.us-midwest-1.vip.tn-cloud.net Software / Resource Hash b11ed2a5705face1c1f6f0430e856bde8c04dd45a5938f4271b0780b91f31bac Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers x-robots-tag noarchive content-encoding gzip age 0 x-content-type-options nosniff date Wed, 18 Dec 2024 23:44:39 GMT content-type text/html; charset=UTF-8 vary X-IPCountry, Accept-Encoding x-frame-options SAMEORIGIN x-vcache MISS strict-transport-security max-age=31536000 link <https://bloximages.chicago2.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin x-tncms 1.84.0; app9; 0.01s; 0.6M content-security-policy upgrade-insecure-requests x-loop 1 referrer-policy strict-origin-when-cross-origin content-length 363 x-xss-protection 1; mode=block
GET H3	200	js Show response www.googletagmanager.com/gtag/	308 KB 104 KB	17ms 17ms	Script application/javascript	142.250.186.136 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-4T2EB147B8&l=dataLayer&cx=c&gtm=45He4cc1v861227858za200zb72758733 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer&gtm=45He4cc1v72758733za200 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.136 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f8.1e100.net Software Google Tag Manager / Resource Hash 9a1d3998b7eee78dc820d25fc2b7b1722ae126b655f9c162572e8543e8794a7f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Wed, 18 Dec 2024 23:44:39 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 18 Dec 2024 23:44:39 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 106632 x-xss-protection 0 server Google Tag Manager
GET H2	200	analytics.min.js Show response cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/	106 KB 30 KB	65ms 11ms	Script text/javascript	13.35.58.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js Requested by Host: www.heraldbulletin.com URL: https://www.heraldbulletin.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.148 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-148.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash c61fcc1401e2278735bea5d306ca0cc32b93ccdf62ec8179ed0c999545b5502b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers access-control-max-age 3000 content-encoding br x-amz-version-id cknvhRie0d.5LSRvFhB35AONaxh2m0FR etag W/"ca62e8a5580d4550920a84f5b7875661" age 60 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id Gbd-FLw4jNVgDmyVwscOWyJOuRsCJhQRjDK-PC7FPvRrwWY7B7f4EA== date Wed, 18 Dec 2024 23:43:40 GMT content-type text/javascript; charset=utf-8 vary accept-encoding last-modified Tue, 19 Nov 2024 19:35:36 GMT x-amz-replication-status COMPLETED cache-control public, max-age=120 via 1.1 343f10c14a24beceec4fd2e9df6f9a50.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P10 server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	settings Show response cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/	10 KB 2 KB	22ms 8ms	Fetch application/json	13.35.58.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/settings Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.148 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-148.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash ecdef5c78d0a9334f51214a96be27839e202e261051445359328c5e8dd2af13a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers access-control-max-age 3000 content-encoding br x-amz-version-id AQinuEJT.z.UEC_DFLs1ij9uoT5_b7cR etag W/"fce9f704656b26e62666fed4fc228a18" age 5292 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id qZKUqREIEkrvEGcsglBv3qSiht_xOkO5YW8aGpm9XgUvTbcPqMETBA== date Wed, 18 Dec 2024 22:16:27 GMT content-type application/json; charset=utf-8 vary accept-encoding last-modified Tue, 17 Dec 2024 19:16:16 GMT x-amz-replication-status PENDING cache-control public, max-age=10800 via 1.1 b8f260e966cae470dbec70a43fd5e0ca.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P10 server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	favicon.ico www.heraldbulletin.com/	318 B 485 B	101ms 101ms	Other image/x-icon	192.104.182.209 LEE-ASN
General Check archive.org Show headers Download Go to Full URL https://www.heraldbulletin.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.104.182.209 , United States, ASN10668 (LEE-ASN, US), Reverse DNS cms.us-midwest-1.vip.tn-cloud.net Software / Resource Hash 65886d83777e6b1ca18975aef2655131422fb4774091464c09fe29b33445a010 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers x-vcache HIT cache-control public, max-age=43200 etag "557891c9-13e" age 31726 accept-ranges bytes content-length 318 date Wed, 18 Dec 2024 14:55:53 GMT last-modified Wed, 10 Jun 2015 19:36:41 GMT content-type image/x-icon
GET H2	200	tsub-middleware.bundle.c0f5511a001f780f591f.js Show response cdn.segment.com/analytics-next/bundles/	18 KB 6 KB	8ms 8ms	Script application/javascript	13.35.58.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/analytics-next/bundles/tsub-middleware.bundle.c0f5511a001f780f591f.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.148 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-148.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"f7b3d2021df83853b191aefa39a74b15" x-amz-version-id ot1syIPz_4SEEXctAcFzoJMAfu_hQEig age 12637220 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id juMjCtmibJqeqUOp-Inza5GE4AweaB7gsQxI0awPBKP1weJJAW2S1g== date Thu, 25 Jul 2024 17:24:20 GMT content-type application/javascript vary Accept-Encoding last-modified Tue, 23 Jul 2024 22:02:58 GMT x-amz-replication-status COMPLETED cache-control public,max-age=31536000,immutable via 1.1 343f10c14a24beceec4fd2e9df6f9a50.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P10 server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	ajs-destination.bundle.ed53a26b6edc80c65d73.js Show response cdn.segment.com/analytics-next/bundles/	9 KB 3 KB	7ms 7ms	Script application/javascript	13.35.58.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.148 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-148.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"00e9c65cbba11c07c4bf4a6e2727b8ea" x-amz-version-id 7HrcoEDii4CJjqNCahwryaG4L.vk9kns age 7865828 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id tGsfS7_OBjH6DC1C7qKgAO5fjfoPoUitWYWKj-Aqju9KjQP-szN84Q== date Wed, 18 Sep 2024 22:47:32 GMT content-type application/javascript vary Accept-Encoding last-modified Wed, 18 Sep 2024 22:21:40 GMT x-amz-replication-status COMPLETED cache-control public,max-age=31536000,immutable via 1.1 343f10c14a24beceec4fd2e9df6f9a50.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P10 server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Show response cdn.segment.com/analytics-next/bundles/	2 KB 1 KB	8ms 8ms	Script application/javascript	13.35.58.148 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js Requested by Host: cdn.segment.com URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.148 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-148.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.heraldbulletin.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"3867b2388b619ff7fddc29ef359fc9aa" x-amz-version-id u16VcQlfwBtHRZyWZ3J5lA.kF3ts0Fc8 age 8029989 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id iaNlkDfiVKk7hzOPQm-LVemM2XjqwV-0EqSnFOTMu0oTjvgqfrzNgw== date Tue, 17 Sep 2024 01:11:31 GMT content-type application/javascript vary Accept-Encoding last-modified Mon, 16 Sep 2024 16:03:18 GMT x-amz-replication-status COMPLETED cache-control public,max-age=31536000,immutable via 1.1 343f10c14a24beceec4fd2e9df6f9a50.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P10 server AmazonS3 x-amz-server-side-encryption AES256

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer object| google_tag_manager object| google_tag_data object| analytics object| googletag function| onYouTubeIframeAPIReady object| TNCMS object| webpackChunk_segment_analytics_next string| analyticsWriteKey object| __SEGMENT_INSPECTOR__ object| AnalyticsNext string| sUserId

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.heraldbulletin.com/	1970-01-21 10:35:01	Name: ajs_anonymous_id Value: 7e6c5fab-d961-46bb-90b0-7c154f7147b8

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.heraldbulletin.com/ Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://www.heraldbulletin.com/tncms/csrf/token/ Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.segment.com
www.googletagmanager.com
www.heraldbulletin.com
13.35.58.148
142.250.186.136
192.104.182.209
2a00:1450:4001:82a::2008
07eebb1571d5cf843235a91d89966af8343eed57c26e689111585ba2aae78c07
129151ed0140041b198ce3b364a11861a3b5baa5bb60475ebf7bedb9b0fc94d6
31892c21ae4fb908a875bbe29dbf0df74c2e84171cfbcac23540f3ad8222a35a
557c67c76c13a84e8b483ee1a0dfdd807399d960909266e7c6a83ddfadca9c81
65886d83777e6b1ca18975aef2655131422fb4774091464c09fe29b33445a010
9a1d3998b7eee78dc820d25fc2b7b1722ae126b655f9c162572e8543e8794a7f
9fe769bfc93145d27bc2efa853ca49895d7a44af9c5dd2566c3233b66c9d14b4
b07d02c8ede625dd16b97254a7d58fb54d63c5906d0c9390a494998d99d495ba
b11ed2a5705face1c1f6f0430e856bde8c04dd45a5938f4271b0780b91f31bac
c61fcc1401e2278735bea5d306ca0cc32b93ccdf62ec8179ed0c999545b5502b
c8975c17d1c96ee87e2cead71ac94942b2cffe95622546ee48e636dbcd7a8287
e1ab9f536e80cb9b49bca8755c8b60f0dad0eca2a4ab06d4ad9a273c07f8e55b
e37ef9c864d52cf2b0153d8b0a93b78b5832d336997d077c92acb10f16c2db85
ecdef5c78d0a9334f51214a96be27839e202e261051445359328c5e8dd2af13a