urlscan.io logo urlscan.io
SecurityTrails logo

www.chedmedturf1.com Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.chedmedturf1.com/?m=1
Submission: On February 02 via manual from BF — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 34 IPs in 5 countries across 34 domains to perform 153 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.chedmedturf1.com.
TLS certificate: Issued by GTS CA 1P5 on December 8th 2023. Valid for: 3 months.
This is the only time www.chedmedturf1.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 2a06:98c1:312... 13335 (CLOUDFLAR...)
7 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
7 54.36.176.112 16276 (OVH)
10 151.101.129.21 54113 (FASTLY)
17 45.133.44.53 39572 (ADVANCEDH...)
1 2a00:1450:400... 15169 (GOOGLE)
2 172.240.108.68 7979 (SERVERS-COM)
9 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 192.229.221.25 15133 (EDGECAST)
1 2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 151.101.193.35 54113 (FASTLY)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 45.133.44.24 39572 (ADVANCEDH...)
1 2a00:1450:400... 15169 (GOOGLE)
5 2606:4700:303... 13335 (CLOUDFLAR...)
10 157.90.84.242 24940 (HETZNER-AS)
2 45.133.44.52 39572 (ADVANCEDH...)
2 3 2a00:1450:400... 15169 (GOOGLE)
3 167.235.163.216 24940 (HETZNER-AS)
12 2a01:4f8:1060... 24940 (HETZNER-AS)
5 2a01:4f8:c0:2... 24940 (HETZNER-AS)
5 2a02:b48:8301... 39572 (ADVANCEDH...)
3 3 31.220.27.135 39572 (ADVANCEDH...)
6 45.133.44.37 39572 (ADVANCEDH...)
153 34
14    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
www.chedmedturf1.com
7    2606:4700:3031::ac43:c7ba (United States)

ASN13335 (CLOUDFLARENET, US)
privacy.gatekeeperconsent.com
the.gatekeeperconsent.com
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
7    2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
blogger.googleusercontent.com
7    54.36.176.112 (France)

ASN16276 (OVH, FR)
PTR: ns3092782.ip-54-36-176.eu
geoloc5.geovisite.ovh
10    151.101.129.21 (United States)

ASN54113 (FASTLY, US)
www.paypal.com
17    45.133.44.53 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
js.wpadmngr.com
51b8b4541b.4d15ee32c1.com
js.capndr.com
fc07b36003.5b10f288ee.com
js.wpshsdk.com
1    2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    172.240.108.68 (United States)

ASN7979 (SERVERS-COM, US)
intellectualhide.com
9    2606:4700:3038::6815:ea1b (United States)

ASN13335 (CLOUDFLARENET, US)
img.root-top.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
3.bp.blogspot.com
3    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
5    192.229.221.25 (United States)

ASN15133 (EDGECAST, US)
www.paypalobjects.com
2    2606:4700:20::681a:fdd (United States)

ASN13335 (CLOUDFLARENET, US)
static.getbutton.io
2    2a00:1450:4001:80e::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.blogger.com
2    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    151.101.193.35 (United States)

ASN54113 (FASTLY, US)
t.paypal.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
2    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
2    45.133.44.24 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
na.nawpush.com
1    2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
5    2606:4700:3032::ac43:ae33 (United States)

ASN13335 (CLOUDFLARENET, US)
storage.multstorage.com
10    157.90.84.242 (Berlin, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.242.84.90.157.clients.your-server.de
fp.metricswpsh.com
2    45.133.44.52 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
js.wpushsdk.com
3    2a00:1450:400c:c09::54 (Brussels, Belgium)

ASN15169 (GOOGLE, US)
accounts.google.com
3    167.235.163.216 (Bühl, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.216.163.235.167.clients.your-server.de
nereserv.com
12    2a01:4f8:1060:13eb::2 (Germany)

ASN24940 (HETZNER-AS, DE)
990a2f6c18.b0624e3ea6.com
5    2a01:4f8:c0:2306::1 (Ehingen, Germany)

ASN24940 (HETZNER-AS, DE)
mcpuwpsh.com
5    2a02:b48:8301::24 (Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
static.bookmsg.com
3    31.220.27.135 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
s.viivideo.com
6    45.133.44.37 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
i.cdnfimgs.com
Apex Domain
Subdomains		 Transfer
14 chedmedturf1.com
www.chedmedturf1.com
86 KB
13 paypal.com
www.paypal.com — Cisco Umbrella Rank: 3015
t.paypal.com — Cisco Umbrella Rank: 3523
276 KB
12 b0624e3ea6.com
990a2f6c18.b0624e3ea6.com
18 KB
10 metricswpsh.com
fp.metricswpsh.com — Cisco Umbrella Rank: 37830
2 KB
9 root-top.com
img.root-top.com
42 KB
7 4d15ee32c1.com
51b8b4541b.4d15ee32c1.com
214 KB
7 geovisite.ovh
geoloc5.geovisite.ovh
522 KB
7 googleusercontent.com
blogger.googleusercontent.com — Cisco Umbrella Rank: 12324
969 KB
7 gatekeeperconsent.com
privacy.gatekeeperconsent.com — Cisco Umbrella Rank: 37569
the.gatekeeperconsent.com — Cisco Umbrella Rank: 31014
139 KB
6 cdnfimgs.com
i.cdnfimgs.com — Cisco Umbrella Rank: 19058
76 KB
5 bookmsg.com
static.bookmsg.com — Cisco Umbrella Rank: 38343
5 KB
5 mcpuwpsh.com
mcpuwpsh.com — Cisco Umbrella Rank: 58611
25 KB
5 5b10f288ee.com
fc07b36003.5b10f288ee.com
1 KB
5 multstorage.com
storage.multstorage.com — Cisco Umbrella Rank: 32053
4 KB
5 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2616
www.google.com — Cisco Umbrella Rank: 2
accounts.google.com — Cisco Umbrella Rank: 23
3 KB
5 paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2611
35 KB
4 gstatic.com
www.gstatic.com
fonts.gstatic.com
73 KB
3 viivideo.com
s.viivideo.com — Cisco Umbrella Rank: 127026
361 B
3 nereserv.com
nereserv.com — Cisco Umbrella Rank: 35934
601 B
2 wpushsdk.com
js.wpushsdk.com — Cisco Umbrella Rank: 72348
147 KB
2 capndr.com
js.capndr.com — Cisco Umbrella Rank: 39610
26 KB
2 nawpush.com
na.nawpush.com — Cisco Umbrella Rank: 51483
4 KB
2 google.nl
www.google.nl — Cisco Umbrella Rank: 9209
515 B
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 79
409 B
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
2 blogger.com
www.blogger.com — Cisco Umbrella Rank: 12161
71 KB
2 getbutton.io
static.getbutton.io — Cisco Umbrella Rank: 50015
121 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
104 KB
2 intellectualhide.com
intellectualhide.com
2 wpadmngr.com
js.wpadmngr.com — Cisco Umbrella Rank: 17201
35 KB
1 wpshsdk.com
js.wpshsdk.com — Cisco Umbrella Rank: 16797
15 KB
1 blogspot.com
3.bp.blogspot.com — Cisco Umbrella Rank: 14261
23 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 37
94 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28
4 KB
153 34
Domain Requested by
14 www.chedmedturf1.com www.chedmedturf1.com
12 990a2f6c18.b0624e3ea6.com js.wpushsdk.com
10 fp.metricswpsh.com js.wpadmngr.com
51b8b4541b.4d15ee32c1.com
10 www.paypal.com www.chedmedturf1.com
www.paypal.com
www.paypalobjects.com
9 img.root-top.com www.chedmedturf1.com
7 51b8b4541b.4d15ee32c1.com www.chedmedturf1.com
51b8b4541b.4d15ee32c1.com
js.wpushsdk.com
7 geoloc5.geovisite.ovh www.chedmedturf1.com
geoloc5.geovisite.ovh
7 blogger.googleusercontent.com www.chedmedturf1.com
6 i.cdnfimgs.com js.wpushsdk.com
6 the.gatekeeperconsent.com www.chedmedturf1.com
the.gatekeeperconsent.com
5 static.bookmsg.com js.wpushsdk.com
5 mcpuwpsh.com js.capndr.com
5 fc07b36003.5b10f288ee.com js.wpadmngr.com
51b8b4541b.4d15ee32c1.com
5 storage.multstorage.com js.wpadmngr.com
51b8b4541b.4d15ee32c1.com
5 www.paypalobjects.com www.chedmedturf1.com
www.paypal.com
www.paypalobjects.com
3 s.viivideo.com 3 redirects
3 nereserv.com js.wpushsdk.com
3 accounts.google.com 2 redirects www.chedmedturf1.com
3 t.paypal.com www.chedmedturf1.com
3 fonts.gstatic.com www.chedmedturf1.com
fonts.googleapis.com
2 js.wpushsdk.com js.wpadmngr.com
js.wpushsdk.com
2 js.capndr.com js.wpadmngr.com
2 na.nawpush.com js.wpadmngr.com
2 www.google.nl www.chedmedturf1.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 www.google-analytics.com www.chedmedturf1.com
www.google-analytics.com
2 www.blogger.com www.chedmedturf1.com
2 static.getbutton.io 1 redirects www.chedmedturf1.com
2 cdnjs.cloudflare.com www.chedmedturf1.com
2 intellectualhide.com www.chedmedturf1.com
2 js.wpadmngr.com www.chedmedturf1.com
js.wpadmngr.com
1 js.wpshsdk.com js.wpadmngr.com
1 www.google.com www.chedmedturf1.com
1 region1.analytics.google.com www.googletagmanager.com
1 3.bp.blogspot.com www.chedmedturf1.com
1 www.gstatic.com www.chedmedturf1.com
1 www.googletagmanager.com www.chedmedturf1.com
1 fonts.googleapis.com www.chedmedturf1.com
1 privacy.gatekeeperconsent.com www.chedmedturf1.com
153 39
Subject Issuer Validity Valid
chedmedturf1.com
GTS CA 1P5		 2023-12-08 -
2024-03-07		 3 months crt.sh
gatekeeperconsent.com
GTS CA 1P5		 2023-12-29 -
2024-03-28		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
geoloc5.idealpes.com
R3		 2024-01-05 -
2024-04-04		 3 months crt.sh
www.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2024-01-24 -
2024-08-21		 7 months crt.sh
js.wpadmngr.com
R3		 2024-01-11 -
2024-04-10		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
*.intellectualhide.com
R3		 2024-01-26 -
2024-04-25		 3 months crt.sh
root-top.com
E1		 2023-12-28 -
2024-03-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
misc-sni.blogspot.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
*.blogger.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
51b8b4541b.4d15ee32c1.com
R3		 2024-01-30 -
2024-04-29		 3 months crt.sh
t.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2023-09-21 -
2024-10-21		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
*.google.nl
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
na.nawpush.com
R3		 2024-01-28 -
2024-04-27		 3 months crt.sh
js.capndr.com
R3		 2023-12-23 -
2024-03-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
multstorage.com
GTS CA 1P5		 2024-01-18 -
2024-04-17		 3 months crt.sh
fc07b36003.5b10f288ee.com
R3		 2024-01-30 -
2024-04-29		 3 months crt.sh
notification.tubecup.net
R3		 2024-01-29 -
2024-04-28		 3 months crt.sh
js.wpshsdk.com
R3		 2024-01-20 -
2024-04-19		 3 months crt.sh
js.wpushsdk.com
R3		 2024-01-12 -
2024-04-11		 3 months crt.sh
b0624e3ea6.com
R3		 2024-01-29 -
2024-04-28		 3 months crt.sh
puwpush.com
R3		 2023-12-14 -
2024-03-13		 3 months crt.sh
static.bookmsg.com
R3		 2023-12-07 -
2024-03-06		 3 months crt.sh
i.cdnfimgs.com
R3		 2024-01-25 -
2024-04-24		 3 months crt.sh

This page contains 13 frames:

Primary Page: https://www.chedmedturf1.com/?m=1
Frame ID: DCB32A724F39F56F7F316BAFA111CCE3
Requests: 117 HTTP requests in this frame

Frame: https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Frame ID: B396AC4828FA58B1DA1F86E05702E667
Requests: 6 HTTP requests in this frame

Frame: https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
Frame ID: 0CC7B02724F050CAF758A6EC7FCE72A9
Requests: 6 HTTP requests in this frame

Frame: https://www.paypalobjects.com/js-sdk-logos/2.2.7/paypal-blue.svg
Frame ID: 5A89ADE92708C37CCEA4A58A350F5B07
Requests: 2 HTTP requests in this frame

Frame: https://www.paypalobjects.com/muse/analytics/index.html
Frame ID: CA95EFED4C8E82E74AF0534E38F7428B
Requests: 3 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: 8C3CBB2CDD621E97DD0D0F5463A49204
Requests: 1 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: BB90A9E3080EDD96BF74697F21B04734
Requests: 1 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: D0F574FB8A7299138DB842A55CB9088A
Requests: 1 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: 4481FE43B0E3ABCBC951C38FA3D4DD01
Requests: 1 HTTP requests in this frame

Frame: https://storage.multstorage.com/log/count.html
Frame ID: F2AF7B75929DD9109A77BA6E594E6204
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: B1709AF36BA5ABC2B3DF30ABE64A42D1
Requests: 3 HTTP requests in this frame

Frame: https://i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/rect_6351150b145e2t1666258187r6216.jpg.webp
Frame ID: 67FC4F6E3292D878ECB77770663C6961
Requests: 3 HTTP requests in this frame

Frame: https://i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/rect_6351150b145e2t1666258187r6216.jpg.webp
Frame ID: 70EE4DC141CB6A9D292571DA50EB6F50
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

chedmedturfgoogle-playkhamsatmostaqlsqueezetradentmessengerblogger

Detected technologies

Overall confidence: 100%
Detected patterns
  • paypalobjects\.com
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

153
Requests

96 %
HTTPS

65 %
IPv6

34
Domains

39
Subdomains

34
IPs

5
Countries

3156 kB
Transfer

7187 kB
Size

9
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49
  • https://static.getbutton.io/widget-send-button/js/init.js HTTP 302
  • https://static.getbutton.io/widget/bundle.js
Request Chain 111
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP 302
  • https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp0_Pm8kqPokLlNK8LDbyG3xKcmN9jgR8Lom2vdqcMsBsuf6r7TPOyWOv5j7xA0ZacGsSL30Ww HTTP 302
  • https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp27Aj3obNFH8Q9mQ-4yeVHZF_SFJtNGdjUgOl16yQNEwkuBPDgiZPRFJ8kcVVhbM51Pv8qYVg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S956928350%3A1706913292834087&theme=glif
Request Chain 141
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyeayyfpbwxezl2jfavcb2hivhwdx3dgvpgm4dtpyaekwrmpjxx25ysgahsy2l5gj3usqkqa5froqjvir6ayi23mnmu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqoupjoffhu7p4lbacjh3cj5bx6ga65rahknee4i2vyomwhbppjzbwv44tbjnewcn4mga6gsahtpmvdmtkyirluhakk4izxh6tzllqexm6bmtqevl4dkdkuxgk5rbbz5svuj2kukqhuubg3omy4mb5wvfklmsi4625djb7yu3c576dxbg3rkm3e2gfffu3u5dlafxnhgr7aofe5mryvtbfn4unhnrajav4n5xl44nnnlga7rz7mo2fdg44apfjskgjkz5xcc5sdw3kb3l3xyzfehwkrgumawahhig4ntjndo2yhuhtzjjxemlfrge6v4zsticp5kpjtdbwamwlakalhy65c4fdqggkhafyeu3sgnrilw5qio5wuucfxgi3eyiqii6h4oirsdjfowm2npcx5gbj3av472ukvzsfcnvkutvuyaqafqe2e3acgkorxhf4m3k3hd4stkb5aw7s6mbzswvqwljzx6zroenbwouzon52tg52aiudfaf2djruutwtnixgfh6sbzf2gz6sll3yedwnsqrgjqr7dsxpxjerr4ge5hvd7zbveozoaj7rwh33jjpuffre6q37db7k4xwelp2gq4p6xbst4thoi372cwzkec62vi5oxw6lapvyud4ztjtyecvxror3doyjw?f=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F7533%2F533%2F6351150b145e2t1666258187r6216.jpg.webp&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=9f1adf49-7366-42e5-aceb-ffa093502a5b&prev_step_diff=447 HTTP 302
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
Request Chain 148
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyeoyyopzxxeyl2i5afmc2aivhgjgfr37rwm4d6frluixt6feycw4qxg4bx223qmn5esqksk4ieatzrjb6vu7qom5mu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqo3g6l3e4k737lbacjh3cj5bx6ga65rahknee4i2vyomwhbppjzbwv44tbjnewcn4mga6gsahtpmvdmtkyirluhakk4izxh6tzllqexm6bmtqevl4dkdkuxgk5rbbz5svuj2kukqhuubg3omy4mb5wvfklmsi4625djb7yu3c576dxbg3rkm3e2gfffu3u5dlaf3nhgr7aofe5mryvtbfn4unhnrajav4n5xl44nnnlga7rz7mo2fdg44apfjskgjkz5xcc5sdw3kb3l3xyzfehwkrgumawahhig4ntjndo2yhuhtzjjxemlfrge6v4zsticp5kpjtdbwamwlakalhy65c4fdqggkhafyeu3sgnrilw5qio5wuucfxgi3eyiqii6h4oirsdjfowm2npcx5gbj3av472ukvzsfcnvkutvuyaqagqe2e3acgkorxhf4m3k3hd4stkauqq5cygz4suvkdlmvswmzke4ldcbrinn6gi42acblquqixdzqutwtnixgfh6sbzf2gz6sll3yedwnsqrgjqr7dsxpxjerr4ge5hvd7zbveozoaj7wgh33jjpuffre6q37db7k4xwelp2gq4p6xbst4thoi372cwzkec6cvj5mhe6lhpz2ed4ztjtyecvxror3doyjw?f=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F7533%2F533%2F6351150b145e2t1666258187r6216.jpg.webp&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=70b32778-ce27-441f-b2d7-8a404de533c5&prev_step_diff=460 HTTP 302
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
Request Chain 156
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyea2qopruheztsinbvkacfjjgwt7xxuwmwm4bnficbcwtzprscsiyrmmcs6pjgmb2esrs2bikbislbiv6qu4c4mrmu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqox7w4rdo432p5ddsjh3cj5bx6ga65rahknee4i2vyomwhbppjzbwv44tbjnewcn4mga6gsahtpmvdmtkyirluhakk4izxh6tzllqexm6bmtqevl4dkdkuxgk5rbbz5svuj2kukqhuubg3omy4mb5wvfklmsi4625djb7yu3c576dxbg3rkm3e2gfffu3u5dlae7nhgr7aofe5mryvtbfn4unhnrajav4n5xl44nnnlga7rz7mo2fdg44apfjskgjkz5xcc5sdw3kb3l3xyzfehwkrgumawahhig4ntjndo2yhuhtzjjxemlfrge6v4zsticp5kpjtdbwamwlakalhy65c4fdqggkhafyeu3sgnrilw5qio5wuucfxgi3eyiqii6h4oirsdjfowm2npcx5gbj3av472ukvzsfcnvkutvuyaqamqe2e3acgkorxhf4m3k3hd4stkaxfyj22nauhybawkr4swytyefcggbjpnurdk6yxc4daaq2ajy2udwtnixgfh6sbzf2gz6sll3yedwnsqrgjqr7dsxpxjerr4ge5hvd7zbveozoaj7dgh33jjpuffre6q37db7k4xwelp2gq4p6xbst4thoi372cwzkee72vibnxu6topj25gvrx4voulzkgoiqdc5q=?f=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F192%2Fq85%2Fimage%2Fvk%2F7533%2F533%2F6351150b145e2t1666258187r6216.jpg.webp&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=ad79329b-b5e0-4ddf-a1c8-eb4e4e5b37e8&prev_step_diff=618 HTTP 302
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp

153 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.chedmedturf1.com/ 		255 KB
53 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470e34af8480c28b69c721fad6fb484b48658adbda73d3425c7e4d2fd8493b84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
cf-cache-status
DYNAMIC
cf-ray
84f5e7652b0e6fb4-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 02 Feb 2024 22:34:51 GMT
display
orig_site_sol
expires
Thu, 01 Feb 2024 22:34:51 GMT
last-modified
Fri, 02 Feb 2024 20:11:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pagespeed
off
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XHIqnblUdyM4kzseZNz4kHB3qPzqEs3ki5lrIaqbrst7IkvEPVY%2B6RkvJDnTwfFzHiobhQjxtkbSeDvVx0%2FseajS7urbJ44Ugs5TEAVeklsKpcXn7s1HO1PkYXo%2FAk8mM%2BWyNFWPcNrG100pG41PvPnvFw%3D%3D"}],"group":"cf-nel","max_age":604800}
response
200
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-middleton-display
orig_site_sol
x-middleton-response
200
x-robots-tag
all
x-sol
orig
x-xss-protection
1; mode=block
tcf2_stub.js
privacy.gatekeeperconsent.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://privacy.gatekeeperconsent.com/tcf2_stub.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86e721bb96c71af08a282151a6246606d325447fc603947cffb628265d7509be

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0nb3P9233eoVif3cTSXt%2F4n1KX7sUIVMs0VmbdLrNXo6SZeT9MB0NiAXE4QN63k7EWHh9S3cUTnFgEH%2FAxkuvy%2F9O4Xl3RonvAZNtGW1kQgFo3o4LM9BhfT6ieJXMUVvQ6DHu2oOJ0z%2F1i5bzBVQGoTHNBVFvjO6C3Ubmg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=15780000, public
cf-ray
84f5e7677fe2d5e9-CDG
alt-svc
h3=":443"; ma=86400
css2
fonts.googleapis.com/ 		39 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?display=swap&family=Roboto+Slab&family=Playfair+Display&family=Lora&family=Rubik&family=Fira+Sans&family=PT+Serif&family=Quicksand&family=Inter&family=Roboto&family=Open+Sans&family=Lato&family=Montserrat&family=Source+Sans+Pro&family=Roboto+Condensed&family=Oswald&family=Poppins&family=Roboto+Mono
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3207e72919c552725824c188790c2d997094c1faa1019bf5b55abfb4216babc7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 02 Feb 2024 22:34:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 02 Feb 2024 22:34:51 GMT
cmp.js
the.gatekeeperconsent.com/v2/ 		179 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/v2/cmp.js?v=151
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49632c68007b262c89478dff0cbda5c8dc983ddaee1cb3725a3eb9a924f62150

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Fri, 02 Feb 2024 07:28:30 GMT
server
cloudflare
age
32247
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zww0hL10q%2FzqEtDDdCyYC%2BMLSHzR6%2F8sd%2FAeb76f8q4mGeif4tYSNzaA6EbTmuOoiyHBdnCa0Ha0SBtc6Hg%2F4xXJ6bDszwLozpbFb4qwLKNFzW8QRvSxDF1CVRIEaPmbeg7t7So139s6S2sa47%2F%2BgBMt1R3wU%2FOA"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=15780000
cf-ray
84f5e767e816d5e9-CDG
alt-svc
h3=":443"; ma=86400
AVvXsEgK1oSu-pPlySL0RaOSznNjD0_TluKVCecKEKr54co3713QRfUUcN0mEfSlX8XxKil7QcDMS0vGln95biwnWjEptsFEbnrngNfq897TA-65kk42whjYYO_Klt3XvTVqh2b2MsSdjbt56MKtVhiHaWOsn4tEkaAPMzz2Kg3Ir5_pc0AjyfuErjzYgcnzg5_T=...
blogger.googleusercontent.com/img/a/ 		164 KB
165 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEgK1oSu-pPlySL0RaOSznNjD0_TluKVCecKEKr54co3713QRfUUcN0mEfSlX8XxKil7QcDMS0vGln95biwnWjEptsFEbnrngNfq897TA-65kk42whjYYO_Klt3XvTVqh2b2MsSdjbt56MKtVhiHaWOsn4tEkaAPMzz2Kg3Ir5_pc0AjyfuErjzYgcnzg5_T=s778
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
cd6484138e1413538458fbd847afaec9a519420805d94c9465af927acb643275
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v10a6"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="Yellow and White Geometric Business Facebook Cover.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
168293
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
Capture%20d%E2%80%99%C3%A9cran%202024-01-06%20083524.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkyyHwfU5ZWyFgKwefhVAWNF5TMFkh-8YF8fhFM2KDZCpARGJHswLP6Xyf6Uw8BBxwg6V1Z17wzvXMH88vFCpi9KK9Ty7cFOGLpTTESGVJ8hqkAJ7Axi59qgLUOHhs9R66tV1wEf_TANuL_9a9... 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkyyHwfU5ZWyFgKwefhVAWNF5TMFkh-8YF8fhFM2KDZCpARGJHswLP6Xyf6Uw8BBxwg6V1Z17wzvXMH88vFCpi9KK9Ty7cFOGLpTTESGVJ8hqkAJ7Axi59qgLUOHhs9R66tV1wEf_TANuL_9a9QCtqZr1enuWnB1q8LuACctNjRriT9C-g-kxxgWfOXDl8/w409-h208/Capture%20d%E2%80%99%C3%A9cran%202024-01-06%20083524.png
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
628dd66807d3b2d412155fbac40f7144cb811db30fc25ba3e79efee1ae9e6c67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v122e"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="Capture d__cran 2024-01-06 083524.png";filename*=UTF-8''Capture%20d%E2%80%99%C3%A9cran%202024-01-06%20083524.png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
34957
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
geocounter.js
geoloc5.geovisite.ovh/private/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://geoloc5.geovisite.ovh/private/geocounter.js?compte=7pea4q23nt7b
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / PHP/5.4.16
Resource Hash
99acd5216966bf76b323ddb9635c1be6ab8556b95520aaf61224eb0bb8320919

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 02 Feb 2024 22:34:51 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/5.4.16
Transfer-Encoding
chunked
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Type
text/html; charset=UTF-8
Connection
close
Expires
Tue, 9 May 2000 11:11:11 GMT
AVvXsEglH_AQny0Vhj9uugwzbx4Qpop1UQxQ_ivarulaAs5uRR-HTQkJQk_pQh7KfFRRCbn3CAr7V05NGB_w7yruaLd5MADwZakPgE8mnJ0ZOL1f3BVI620XeshIZA0SCTg43ib385c9vTYAIWrJYrD6ux21-ZtNh5abqHoYrfNwLKMKa8nFvOCcOdRTX3wgY_-O=...
blogger.googleusercontent.com/img/a/ 		142 KB
142 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEglH_AQny0Vhj9uugwzbx4Qpop1UQxQ_ivarulaAs5uRR-HTQkJQk_pQh7KfFRRCbn3CAr7V05NGB_w7yruaLd5MADwZakPgE8mnJ0ZOL1f3BVI620XeshIZA0SCTg43ib385c9vTYAIWrJYrD6ux21-ZtNh5abqHoYrfNwLKMKa8nFvOCcOdRTX3wgY_-O=s1600
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
ef478ed80c13ec32ae90c53076046c928ac583d3520b92d94a2c9aa2c42f71fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v1270"
vary
Origin
content-type
image/jpeg
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="WhatsApp Image 2024-02-02 at 20.43.57.jpeg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
145218
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
AVvXsEhx3EC1xZRKVC1HKCfQQF3X1EDLlnV5K8mfvT02BchggqQxoHASROtl5NlLZ4Hx6_kzXftIRz9L_qVlFbngEgsegcbZX5h3OVvQZQg8rxjkVIkQY8O_VLUz-L-TKN-srP0_rrDdkU8Qd00MMN9GwRFQOpQwHpNFuBzCD3yRdAkKCQipqPD9C3ycCFZvXHuU=...
blogger.googleusercontent.com/img/a/ 		134 KB
135 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEhx3EC1xZRKVC1HKCfQQF3X1EDLlnV5K8mfvT02BchggqQxoHASROtl5NlLZ4Hx6_kzXftIRz9L_qVlFbngEgsegcbZX5h3OVvQZQg8rxjkVIkQY8O_VLUz-L-TKN-srP0_rrDdkU8Qd00MMN9GwRFQOpQwHpNFuBzCD3yRdAkKCQipqPD9C3ycCFZvXHuU=s1600
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
da3db5db384db589fcb253a7544b8b5124a488de54e9e41947529a0018257dee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v1268"
vary
Origin
content-type
image/jpeg
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="WhatsApp Image 2024-01-30 at 14.14.29.jpeg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
137545
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
AVvXsEg7jbde-NGWD4VgS9uB85p1XdA72vb57QQ5xXDWqDQKMXGmbaj94HJcdhht9Q7yHp44m7O0WlG88TCSVr0idVF-SDKNp6QLgl3j2fKnscp4Y6i-fY8GhmJQAvrUrZBqf5QfUouNXFmAEJTx9cZGwb9pbg6g4B9Ku5l0ay3rQYn_O9sx0CZr3pSrhFkZpLnU=...
blogger.googleusercontent.com/img/a/ 		210 KB
210 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEg7jbde-NGWD4VgS9uB85p1XdA72vb57QQ5xXDWqDQKMXGmbaj94HJcdhht9Q7yHp44m7O0WlG88TCSVr0idVF-SDKNp6QLgl3j2fKnscp4Y6i-fY8GhmJQAvrUrZBqf5QfUouNXFmAEJTx9cZGwb9pbg6g4B9Ku5l0ay3rQYn_O9sx0CZr3pSrhFkZpLnU=s1600
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
47af11196f463dc4b43db4eedc61bcfe8498fa40112ae681218b7cad7b242f46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v1265"
vary
Origin
content-type
image/jpeg
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="20240129_161826.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
215097
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
AVvXsEj_yYStjzAS1Zze2u4rEEJ3WZnORuBy-3Gmd9NC-LFh8PKd28taaxvXEvEenczwBTbiZBps3ks9wpc0Sqdw2RtxV4fkTiam7stlP_bXSsSw0eUAceBCEIvYlE99WkaFQBqiQNDe4ZI9SexN0S0ar8m6NkVIOx1a8KqX_CMQV6e2zNj9tSO9XhwFhnCWQG8P=...
blogger.googleusercontent.com/img/a/ 		265 KB
265 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEj_yYStjzAS1Zze2u4rEEJ3WZnORuBy-3Gmd9NC-LFh8PKd28taaxvXEvEenczwBTbiZBps3ks9wpc0Sqdw2RtxV4fkTiam7stlP_bXSsSw0eUAceBCEIvYlE99WkaFQBqiQNDe4ZI9SexN0S0ar8m6NkVIOx1a8KqX_CMQV6e2zNj9tSO9XhwFhnCWQG8P=s1600
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
6065f8f718670e4deec4ee9f2b5b65da4af0e7f3d52522dbfb264c4b2a1db31a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v1261"
vary
Origin
content-type
image/jpeg
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="Screenshot_20240129-140118_WhatsAppBusiness.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
270954
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
js
www.paypal.com/sdk/ 		294 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
acf50b68bf1e14208d043310bb36ca773e8ac79c6519f4f8d7a2562791997459
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy
default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding
gzip
x-content-type-options
nosniff
disable-set-cookie
true
via
1.1 varnish, 1.1 varnish, 1.1 varnish
date
Fri, 02 Feb 2024 22:34:51 GMT
age
4182
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
HIT, HIT, MISS
p3p
true
paypal-debug-id
f5553809429e8
server-timing
"traceparent;desc="00-0000000000000000000f5553809429e8-35f748c08092383c-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
content-length
80126
x-xss-protection
1; mode=block
x-served-by
cache-fra-eddf8230079-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f5553809429e8-f2a1a26dba887678-01
x-timer
S1706913292.538075,VS0,VE5
etag
W/"138fe-102c8G2EWCfaq4yNbgs9AIqF/Ms"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
Server-Timing
cache-control
public, max-age=3600, s-maxage=10800
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
bytes
x-cache-hits
4, 1, 0
adManager.js
js.wpadmngr.com/static/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.wpadmngr.com/static/adManager.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
b78c5c3f93b9d9d8dcb46d08d4f67cbcf71ff8b2ec96c03543fc377ce446b6e6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:51 GMT
date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
gzip
last-modified
Fri, 02 Feb 2024 08:23:42 GMT
server
nginx/1.18.0
etag
W/"65bca68e-6c3"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
js
www.googletagmanager.com/gtag/ 		284 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-3QV3GWMZM4
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f00d6a10bc408d02d701a790cf5a528df1868f4c39316daef39c7ed4241d506b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
95835
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 02 Feb 2024 22:34:51 GMT
5bb79dc1f95d0cdbe2931d863feafbd2.js
intellectualhide.com/5b/b7/9d/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://intellectualhide.com/5b/b7/9d/5bb79dc1f95d0cdbe2931d863feafbd2.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.240.108.68 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.21.6
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
banner.gif
img.root-top.com/topsite/pmuturf/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/pmuturf/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
506218
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o7vNn4Kq4%2F9fGcdx7MzOudTfp6EYm%2B%2FjBPkW3FgdQ8QH7kuwsQNN1QH56uWlaiHtFbA0a7yy7M5sNrCV0N8cwZjURDjLaQeOGiWbLJi2m7Dl3h9V2Y4YBbLGpg6xUYrKO6sqCH9B%2FSdr49CJsQ1V"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ed1b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/megaturf/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/megaturf/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3002
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yt4i03dfx6zZmVzBdtAQbVCfdUjh5Cufy407Qta3yqPfldImu9TQ8iDVM3zJL9h7MBBkNruXEcCCX0jXYIL908bfBQ%2FHV8b2Zg07yvG7rFo8Yl3RtfKi%2F%2FOoYOUmTDCP5Y7HHJSr7TvSSLEGmi6D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ed7b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/topturfjs/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/topturfjs/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
507421
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZKVMYKdLof9gE5Wkjbc7UdPblFN6sqpXZ9zn9H%2BrcforX1kfiWdFert%2BieNRcjOtkZEyVe4OizwO45LtVDMSjX40Z%2B5ru9MFlv2iBcfUPpppUk7x1AHocXlP8fvCwSt09eFVvfUZBAsvl1N6yiW5"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee0b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/tofturf/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/tofturf/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
455
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BMsQerQdZZV%2BkMTEzl3bohAZ0FsUiAQl76cXBuq2g8AoyZCLEVF%2F6AyLMGH7Yhr8T8z73g6fvw9ao%2BE%2Bnujqr0sCiDIo1h9dPz6fX8%2FEoEvaOl78ExbxJ%2FiHy5rEKop9GSkiwu8ZgWWe8TDiphUW"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee2b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/turfistes/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/turfistes/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1704
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VoYcxICIbWZcqvireFvnPyCYU%2BS1SXftMdectOam%2BFgYzBAJhjTMwPOJexyMPMg2CERviasiWs0yRclPs0E9cleJoRoXzTL1s0HIMYAoaiydz%2F%2BOwZv7WPE2XVVuDJM6u%2Bjf3U9HlrQHcdeK3yoK"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee3b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/turfbase/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/turfbase/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
162189
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKl0%2BEXRpkv7oZbiOW9ojTj1ONQRFAXWqE08TCCXOlWkxBQssKiG5sZzcMAHfa8FobURmTvhz4%2B92sho5gGfOetEEp5C3FFBnRUunua0chGUinKE%2FDgznPzdaGtkbRamSOrYtE1rF4aP2keB7dRt"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee4b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/jmpep80top/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/jmpep80top/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
7089
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBPl9O10CrM57oaaRDPGaCANdN4GmDUsi69ICQBLs%2FwcMuqkxWrs4YGqF63AS35QF2t057yn4VRzNdKjuncKGRFI33085HWMzoHg5LOIzGCENm416Im%2Bcfct6vkAx724B%2FUJAkYb37EIKH7lPoPD"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee6b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/turfoscope/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/turfoscope/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
7021
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZdVKl9hs2T54Zsp0JOJFaTAeTJHOJcD2Z52TjmX4qkWvBTNwSCzAZ0PjujSJ%2BHwkOvsxeAAjdLre%2BtnwVVywhy4%2FR5gEIG5IxWLQVUPJE8XL2vDuk3yHm%2B1xp8FcMM0vRrZuI%2Fh5Yh1eAvnJFjE"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7681ee7b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
banner.gif
img.root-top.com/topsite/guideturf/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.root-top.com/topsite/guideturf/banner.gif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ea1b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 12:52:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2322090
etag
"1229025579"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u0ZEUnoEzzzuTuLYNO1jUo1fH%2F30I2YepU%2F%2FJTW%2BqfInK8mP2Z56yXjXXzuE75F1YESLEOt3Zf%2BWCtxOMhgtVbPOjZbWZV0qEQ%2FiXUDHPbc5AU%2F%2BYn55aZca8u6V4pogwqfTGjfKh%2FL%2BWLf5bcg4"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
84f5e7682ef5b8d0-AMS
alt-svc
h3=":443"; ma=86400
content-length
4424
AVvXsEiUdq9ljrplbrGxzTD9ZRjpezeXVaWmJ_rSpYQf3Tq_kVyNV0z6idN1AEHigC5UIsSGwuchyeeJ7tVsgIMC6B2uXQzpc0xDHRlks1mXkeGVUydVbi7qLKODjQGANE5qihsbmiSHug0EDZGztfWtuEH8Y6q2J2mZRvNyvaZzr8U9bUezuxoEn0XOrHbeNpZn=...
blogger.googleusercontent.com/img/a/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/a/AVvXsEiUdq9ljrplbrGxzTD9ZRjpezeXVaWmJ_rSpYQf3Tq_kVyNV0z6idN1AEHigC5UIsSGwuchyeeJ7tVsgIMC6B2uXQzpc0xDHRlks1mXkeGVUydVbi7qLKODjQGANE5qihsbmiSHug0EDZGztfWtuEH8Y6q2J2mZRvNyvaZzr8U9bUezuxoEn0XOrHbeNpZn=s1600
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c81f39c34f1b76539d5bd5944c808c67ea754d7e354caa9a616072d8fa5036b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
x-content-type-options
nosniff
server
fife
etag
"v1210"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="Capture d__cran 2023-12-29 183548.png";filename*=UTF-8''Capture%20d%E2%80%99%C3%A9cran%202023-12-29%20183548.png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18785
x-xss-protection
0
expires
Sat, 03 Feb 2024 22:34:51 GMT
loader.js
www.gstatic.com/charts/ 		61 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/charts/loader.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 21:56:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2311
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18534
x-xss-protection
0
last-modified
Tue, 04 Apr 2023 17:52:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="gviz"
vary
Accept-Encoding, Origin
report-to
{"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type
text/javascript
cache-control
public, max-age=3600
access-control-allow-credentials
true
accept-ranges
bytes
expires
Fri, 02 Feb 2024 22:56:20 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.0/ 		86 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.0/jquery.min.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
5591282
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27781
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15857"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=caqns5QNgzuNMbunpBTU7hewJWZSMN%2FQjx6pTMK1PCnjVOzhZ8r3dlmVP4u8mrzhESxTY2CIqdKtvKSW3CHy42XK4X%2BGrQXjD6VvjHeaY0LAbPGhzoM7Wtem9oWaH9o96wvz65jviEePOqrJU2%2Bf%2FLOi"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84f5e7685a813661-FRA
expires
Wed, 22 Jan 2025 22:34:51 GMT
boise.js
www.chedmedturf1.com/detroitchicago/ 		863 B
869 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/detroitchicago/boise.js?gcb=195-0&cb=4
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0a0701b182bd4986bf16d3796251c0db1d92c6f8487866e6f6bbbd81cd1a3dd

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
708195
cf-polished
origSize=876
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 25 Jan 2024 17:51:36 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HdBULu8fg6aqGbUn6AuxsD67%2FbKysz9eT3zZz%2FhhhaNJmnJFG8a6eaSIgzshaVeaNSOHqZfEngP2na8XJoM0x8YVvtDybDRJsEUjge8QsMqy59Tr4EPiDl5uKsl27PoAXffQZ%2BZL%2BYHa6qinm%2FfCoTeAEA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e767dd5e6fb4-CDG
abilene.js
www.chedmedturf1.com/parsonsmaize/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/parsonsmaize/abilene.js?gcb=195-0&cb=32
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f66e281a1c148d2ca48792ca323dab41f372e3e22bb4a452a740c5c7b0ba9195

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3880711
cf-polished
origSize=6320
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Wed, 20 Dec 2023 00:36:20 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B8TinVi2hqvaE9UlTZ%2F4GHWmVDPZ4k5kFW4HBinyASZdXErfknsCHqiK3M6qLZrAVbv8sOfAGiwHy9MEtLTI5L9E%2FSKlVl1x9vMX7BaB0YZyqaTuMfh%2FEJDu%2FPA0lGVHsQLzXXqYbwk%2F%2F3Nrl35YIz1Bjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e767dd5f6fb4-CDG
et.js
www.chedmedturf1.com/porpoiseant/ 		1 KB
896 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/porpoiseant/et.js?gcb=195-0&cb=2
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6743242
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 16 Nov 2023 21:27:29 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xRhXGpGn69JZQN7CBwPiWuxJuKQFj24QFRd6eUxa2VStzHCvZMGA5RSMvXhrcj4lJ%2FIHi%2Bl5Q9qwjEbnTSXw1Fs%2B9fzLgPYqFf07EGWXKeBWC8kLZIQUxP6OHWcyhtl7rmLEAeFypK7xHHdwXr%2BBeBiinw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e767dd606fb4-CDG
SqBack.jpg
3.bp.blogspot.com/-TTjKNu81qZc/WmZwH-ZbHiI/AAAAAAAAAIE/5AD2e-RqhbUjv2-w13HQ5o8jFF_0krT-ACK4BGAYYCw/s1600-e90-rw/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://3.bp.blogspot.com/-TTjKNu81qZc/WmZwH-ZbHiI/AAAAAAAAAIE/5AD2e-RqhbUjv2-w13HQ5o8jFF_0krT-ACK4BGAYYCw/s1600-e90-rw/SqBack.jpg
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
6e8e676aa36b985b06d8c29ee0fc9741de544c35abe7c9dc4e77f51c8558b0ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 19:57:39 GMT
x-content-type-options
nosniff
age
9432
content-disposition
inline;filename="SqBack.webp"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23652
x-xss-protection
0
server
fife
etag
"v84"
vary
Origin
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=7776000, no-transform
timing-allow-origin
*
expires
Thu, 02 May 2024 19:57:39 GMT
invoke.js
intellectualhide.com/68cb2163d05db9b977f8cdf4713d58a5/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://intellectualhide.com/68cb2163d05db9b977f8cdf4713d58a5/invoke.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.240.108.68 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.21.6
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
SLXGc1nY6HkvalIhTps.woff2
fonts.gstatic.com/s/cairo/v6/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cairo/v6/SLXGc1nY6HkvalIhTps.woff2
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5cb3d6eb9c192f0339126dc9290c8cdc286512f79318d9a6e5033b2ebb93e8cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.chedmedturf1.com/
Origin
https://www.chedmedturf1.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Thu, 01 Feb 2024 23:26:10 GMT
x-content-type-options
nosniff
age
83321
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20772
x-xss-protection
0
last-modified
Wed, 17 Jul 2019 00:04:13 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 31 Jan 2025 23:26:10 GMT
mulvane.js
www.chedmedturf1.com/parsonsmaize/ 		1 KB
936 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/parsonsmaize/mulvane.js?gcb=195-0&cb=6
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9af49c10c5a8062e5fde477550c3669bdbd09fc5b9d6eee319e808740744e7d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4843262
cf-polished
origSize=1132
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Fri, 08 Dec 2023 21:13:49 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fCrLlC9ZMYv6%2BLi2WpFtrRQ49mPt9RW3hNWhb2gLkubHMBiQ1vdOIGTC0QkSf%2BhgxB2wRZl40uzj26hdgkEuJdNpKbtAv4n40tCUFpIIbsXGsBMe0D1VUEtcAioShOrThFnh0bBIuLvpoi0i0lEYiOGlJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e7681d8e6fb4-CDG
wichita.js
www.chedmedturf1.com/detroitchicago/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/detroitchicago/wichita.js?gcb=195-0&cb=12
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d7a77f24fc31abf310ccb240b2e0a49f2582823f990eef11a3abc37f286ea12

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3810058
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Wed, 20 Dec 2023 20:13:53 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YZbFt6afVp0iE252bLhaFlLyNUzTm1BwCnzyaEx7xYJH%2Fwlaw2M2pbe%2BcLUve7m4RrTKrKIUQKOQvfmoqFAYFY%2BhjiaRqm71iX2doDrWexDj%2BuRuAhadZYSJW%2BE5mUt0CC5S%2FM9FIKhglYt88fqyLHBMDw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e7681d916fb4-CDG
raleigh.js
www.chedmedturf1.com/detroitchicago/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/detroitchicago/raleigh.js?gcb=195-0&cb=7
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9fba7686001b516b0414bef328255eca729f278c1d14d324c8567733426439a5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3881880
cf-polished
origSize=1673
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Wed, 20 Dec 2023 00:16:51 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2FvGrh0CsKOEIqKFwMRr%2FcXwc4dO7MdEf1r39yMmWUpDko1n3omzqOY4%2F2eVGDUvLMCBxStTZtQftikZVR26YUdmg9lwGk2DH7dERg2nIUKqERgHUQgHdQvGPhjoV4RxRJvREEP6glwjrCVr2Dp3bAk0Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e7681d926fb4-CDG
vista.js
www.chedmedturf1.com/detroitchicago/ 		1 KB
833 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/detroitchicago/vista.js?gcb=195-0&cb=6
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4559f063977072488f6dd2c96ff11fa2dbfc62c9e26d1b8c2c80c48a85964ecc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
707365
cf-polished
origSize=1067
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 25 Jan 2024 18:05:26 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NEqiGB2Az8n0paTWomWC1Uo4h2K%2FL%2FP%2BU5Ae8GTPj7h%2FtTouPv1eUVLC3d%2FJHZ%2BHLMqzy88jRmjBEdjFrgifmzPFGBdlgEk5JnBELoe%2Fa4F8D8dnfdOr3V49KOUd6GXfCkTK3MoS7KteRQwv2UCVIgl0Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e7681d936fb4-CDG
config.json
the.gatekeeperconsent.com/v2/ 		16 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/v2/config.json
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=151
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dccb2b98943fa6b1c7bbc0d631efa07d7f0eea5873fed74a09bb77ffbc30410a
Security Headers
Name Value
Content-Security-Policy default-src 'none'
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-security-policy
default-src 'none'
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
br
vary
Accept-Encoding
x-frame-options
deny
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fn3ivUwYzRLrF3VjECyR6apzKCPJpfR%2FK7WJPwgX91M9nOxZMnF2wmG%2B9mWkQM0xD5B0Yrc3svTEbrqP4LOwzevtnjBdD1PYJQgAhGaPQNkA91fWkoVolz3F9ahwYES%2BeqIYAcFvi5bhxreT%2B8ccogPIEdQg2crd"}],"group":"cf-nel","max_age":604800}
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
cf-ray
84f5e768794e65ac-FRA
alt-svc
h3=":443"; ma=86400
olathe.js
www.chedmedturf1.com/parsonsmaize/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/parsonsmaize/olathe.js?gcb=195-0&cb=23
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e95dbe814ec64151e2a610cbed23b66909cb781c0ab20b6fa026f3e0f71f227

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3767591
cf-polished
origSize=2255
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 21 Dec 2023 08:01:40 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bXwBBQobPG9jIFP6zBht%2FwThQAjohOrZKPyWeMoe2Qpl8jxgCfn0Md2hU2wZMJV6CHlJukN8uMjkmHcJCJJI1e5xEmWJ56oRFGVbLiQaapy4mXyPslN7ELgByjpawhflp6yr0NpVuZy32n8NDocXU4ZX5g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e7685d7f3671-FRA
imp.gif
www.chedmedturf1.com/detroitchicago/ 		43 B
782 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/detroitchicago/imp.gif?ez_orig=1
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/parsonsmaize/abilene.js?gcb=195-0&cb=32
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.chedmedturf1.com/?m=1
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-middleton-display
imp_sol
alt-svc
h3=":443"; ma=86400
content-length
43
server
cloudflare
access-control-max-age
1728000, 1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.chedmedturf1.com, https://www.chedmedturf1.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6L9N0nh43S8ZZMcORS%2BRBdFKJro%2Fq2CD1wYZqMBAB1Rg%2BfZbEagHZsFytJzqDWAtG68voDIFNQeWcDOMfCKqqNd4BJLZUBS2WtZZFX83%2BJsw5aaz9Unk1scVpFa2fgCcZ837V6AE8TwSG5awMtQBqKBAxA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials
true
vary
Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
cf-ray
84f5e7688da33671-FRA
access-control-allow-headers
Content-Type, Content-Type
expires
Thu, 01 Feb 2024 22:34:51 GMT
gvl.json
the.gatekeeperconsent.com/cmp/ 		566 KB
71 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/cmp/gvl.json?v=4&lang=en
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=151
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
12ee6ccaa9b562aa22df51c93464d0bc483dd35ed9eef40d9e7cd8b06c609b4f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 24 Jan 2024 23:05:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
264008
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evP%2FxiGOj3Jr6JnVyL0PDjHtnoP3g4k0ulrz4Fb%2BDN1WjOShNKl4uXV12ri52tR8vIkDrVCFEN0frN2GJ7cuG1nmPo7qUpczmoslu%2Fbx5lflB1ybl8pM5l5o1h0t0ldDDToCDbAgdN26h1dcYbgSjpVVBzGud8Jm"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=345600
cf-ray
84f5e768d9b665ac-FRA
alt-svc
h3=":443"; ma=86400
main_modal_firstpage
the.gatekeeperconsent.com/cmp/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domainId=200701&region=default&lang=en-US&cb=151&changeLogId=364308
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, PUT, OPTIONS
access-control-allow-origin
https://www.chedmedturf1.com
access-control-max-age
1728000
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e7697a4465ac-FRA
content-length
0
content-type
text/plain; charset=utf-8
date
Fri, 02 Feb 2024 22:34:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fd71gtPEWKSK6uQq8cVCp7GfBUuBap8OfqB6br8Cceb71zpA1REbeb49x5QbftuD1XNlXux5UEQ3aL3xSsqWa%2BiV7Z0w20AOvTuHDQgKZJyLEn8omoTW9IBw4EIVWo6iMYvnwFtSUPnDVhxOy98yqoc3s8SV8Fr9"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
loadLanguages.json
the.gatekeeperconsent.com/v2/ 		50 KB
17 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/v2/loadLanguages.json
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=151
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
498f22cc18a63857f7b415eb9872e54236582d2a25a4dc5614302a2207e76d42
Security Headers
Name Value
Content-Security-Policy default-src 'none'
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-security-policy
default-src 'none'
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
br
vary
Accept-Encoding
x-frame-options
deny
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oLdwKGxGMI9Nfux92p4DMwhgSgATtODn6GkXcStBhbK4gz1i6tcEJSs003WZKIVs3Ckaed78s2ksqcqW%2BtRMBCNI9E8D8jNArove%2Bkxjs0hfxfMOid1iUFgQZm%2BDJIQvsjB2Ey%2FAmQ6MdqLKw9mAA8S971H7p96D"}],"group":"cf-nel","max_age":604800}
cache-control
private, max-age=0, must-revalidate, no-cache, no-store
cf-ray
84f5e7697a4365ac-FRA
alt-svc
h3=":443"; ma=86400
main_modal_firstpage
the.gatekeeperconsent.com/cmp/v2/ 		22 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domainId=200701&region=default&lang=en-US&cb=151&changeLogId=364308
Requested by
Host: the.gatekeeperconsent.com
URL: https://the.gatekeeperconsent.com/v2/cmp.js?v=151
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:c7ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4fc468991137d09453f90b5b4573f0f575db6721ae6c1cb3efc4818931561166

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 02 Feb 2024 22:34:51 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
30922
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 02 Feb 2024 13:59:29 GMT
server
cloudflare
access-control-max-age
1728000
access-control-allow-methods
GET, POST, PUT, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.chedmedturf1.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRVV6JGsQAK9G4YYa5f7sP%2BB4ScWHCR2wOYYQeKpZipP9H1kwtKmPijWQUMfs%2Bmn%2B4l9nNafDmd9R4CT7Xla2pQyQU0ef%2BHeAZM2VLNtcLxpU3GBNNnkfe0lhtZ7UyotpUw%2BTbVVdpK0SmS8QEL2Ii6sCThaq8nE"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=2592000, public
access-control-allow-credentials
true
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
cf-ray
84f5e769aa6965ac-FRA
access-control-allow-headers
Content-Type
geocounter_iframe_css_64.php
geoloc5.geovisite.ovh/private/ Frame B396 		306 KB
307 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Requested by
Host: geoloc5.geovisite.ovh
URL: https://geoloc5.geovisite.ovh/private/geocounter.js?compte=7pea4q23nt7b
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / PHP/5.4.16
Resource Hash
563f9dcb6f5643dcf54839299ecbba4d6523792b1f25ac6475162f0400884f93

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
close
Content-Type
text/html; charset=UTF-8
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Transfer-Encoding
chunked
X-Powered-By
PHP/5.4.16
pointeur.gif
geoloc5.geovisite.ovh/private/geoloc/ 		43 B
257 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://geoloc5.geovisite.ovh:4433/private/geoloc/pointeur.gif?|7pea4q23nt7b||1200*1600|windows|en|24|1706913302|||chrome|121||NL|51.95310|5.90970|Arnhem|LeaseWeb+Netherlands+B.V.|1706913291|geocounter|3600|1706913291|||https%3A//www.chedmedturf1.com/%3Fm%3D1|NULL
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
lighttpd/1.4.54 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Last-Modified
Tue, 04 Mar 2008 08:22:49 GMT
Server
lighttpd/1.4.54
Accept-Ranges
bytes
ETag
"2777121996"
Content-Length
43
Content-Type
image/gif
pptm.js
www.paypal.com/tagmanager/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/tagmanager/pptm.js?id=www.chedmedturf1.com&t=xo&v=5.0.421&source=payments_sdk&client_id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&disableSetCookie=true&vault=true
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
52a543aadcbc40f2d90d859fe30a36ed78b2df0bbfc0ae64c6a989f5f38fa06d
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-8LJFRo407fUMZViwDpBiZaubGhR4t43Ub3KsOKKb3FX1hO12' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy
default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-8LJFRo407fUMZViwDpBiZaubGhR4t43Ub3KsOKKb3FX1hO12' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://nexus.ensighten.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 02 Feb 2024 22:34:52 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security
max-age=63072000; includeSubDomains; preload
age
8904
x-cache
HIT, HIT, MISS
paypal-debug-id
f2608182641ba
server-timing
content-encoding;desc="gzip",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
content-length
4780
x-xss-protection
1; mode=block
x-served-by
cache-fra-eddf8230118-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f2608182641ba-f6bf9bd38e771127-01
x-timer
S1706913292.316611,VS0,VE7
etag
W/"3673-dr0ZnISoQvFuu7Bt+IW4Pd9wwJg"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=3600
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
bytes
x-cache-hits
1, 1, 0
buttons
www.paypal.com/smart/ Frame 0CC7 		410 KB
105 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7bb15ee4e4f34c369ca83927f2ac810093e6a024c5c362f7cbf681aa22a18b7d
Security Headers
Name Value
Content-Security-Policy form-action 'self' https://*.paypal.com https://*.cardinalcommerce.com; default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.googleapis.com https://*.firebaseio.com wss://*.firebaseio.com https://api2.amplitude.com http://127.0.0.1:* https://*.qualtrics.com; frame-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.cardinalcommerce.com https://*.firebaseapp.com https://*.qualtrics.com; script-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval' https://apis.google.com; style-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; object-src 'none'; img-src https: data:; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges
bytes
access-control-expose-headers
Server-Timing
cache-control
max-age=0, no-cache, no-store, must-revalidate
content-disposition
inline
content-encoding
gzip
content-security-policy
form-action 'self' https://*.paypal.com https://*.cardinalcommerce.com; default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.googleapis.com https://*.firebaseio.com wss://*.firebaseio.com https://api2.amplitude.com http://127.0.0.1:* https://*.qualtrics.com; frame-src 'self' https://*.paypal.com:* https://*.paypalobjects.com https://*.cardinalcommerce.com https://*.firebaseapp.com https://*.qualtrics.com; script-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline' 'unsafe-eval' https://apis.google.com; style-src 'self' https://*.paypal.com:* https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; object-src 'none'; img-src https: data:; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-type
text/html; charset=utf-8
date
Fri, 02 Feb 2024 22:34:52 GMT
dc
ccg11-origin-www-1.paypal.com
etag
W/"668f6-pCSSZuVNfqZNq7SgUk/DWR9FLns"
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
p3p
true
paypal-debug-id
f169310c6203c
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing
"traceparent;desc="00-0000000000000000000f169310c6203c-81deb31fc0a4cdf8-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
traceparent
00-0000000000000000000f169310c6203c-ee74ec961059bcd5-01
vary
Accept-Encoding
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, MISS, MISS
x-cache-hits
0, 0, 0
x-content-type-options
nosniff
x-csrf-jwt
__blank__
x-served-by
cache-fra-eddf8230044-FRA, cache-ams21082-AMS, cache-ams21082-AMS
x-timer
S1706913292.358348,VS0,VE380
x-xss-protection
1; mode=block
paypal-blue.svg
www.paypalobjects.com/js-sdk-logos/2.2.7/ Frame 5A89 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/js-sdk-logos/2.2.7/paypal-blue.svg
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/4894) /
Resource Hash
25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
HIT
paypal-debug-id
1867a673a7a0f
dc
ccg11-origin-www-1.paypal.com
content-length
1217
last-modified
Tue, 04 Apr 2023 21:46:19 GMT
server
ECAcc (ama/4894)
traceparent
00-00000000000000000001867a673a7a0f-f3dfb61d7baab926-01
etag
W/"642c9aab-cc2"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
expires
Fri, 02 Feb 2024 23:34:52 GMT
card-white.svg
www.paypalobjects.com/js-sdk-logos/2.2.7/ Frame 5A89 		1 KB
761 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.paypalobjects.com/js-sdk-logos/2.2.7/card-white.svg
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48CD) /
Resource Hash
1c4c2e6fd8a12889bc2ab350338566579ae079850e59701c8bf55ba52abd4d6b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
HIT
paypal-debug-id
1d478ed69fe51
dc
ccg11-origin-www-1.paypal.com
content-length
637
last-modified
Tue, 04 Apr 2023 21:46:19 GMT
server
ECAcc (ama/48CD)
traceparent
00-00000000000000000001d478ed69fe51-f4a949f38f31de5d-01
etag
W/"642c9aab-54e"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
expires
Fri, 02 Feb 2024 23:34:52 GMT
bundle.js
static.getbutton.io/widget/
Redirect Chain
  • https://static.getbutton.io/widget-send-button/js/init.js
  • https://static.getbutton.io/widget/bundle.js
417 KB
120 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.getbutton.io/widget/bundle.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Server
2606:4700:20::681a:fdd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
756c4b07ecaf70170ca6800deaa650bc4c001d54314e454cb1776fc6240d62a0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 30 Jan 2024 10:53:48 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
8388
etag
W/"65b8d53c-684fe"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CGsqCVaPCQ2k35gKU%2FrghKs32x9Iwy%2FfCnKzehyeb0b%2F%2FzWS64N5Qcc6UIMuBPO2kuKkrpSDtkV5DyQj6aGF0ZKF%2BOFkaVFCnGDmBVWXotagmSzVHO2EqliskiPN27Nx04PsMaRE3ukhBuGjZSfrU4w%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
84f5e76dde2e35ea-FRA
expires
Fri, 02 Feb 2024 23:15:04 GMT

Redirect headers

date
Fri, 02 Feb 2024 22:34:52 GMT
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ibsfpTEezH9gABMak39jr1ZZiY%2B%2F1YAmDmBDZhwUOu3KR4meZI8Q1FnZjFRHr2QxJT22Zri6dW%2BEhn5kbiXsSbIZmZbl7S5tm7D8984t7hWhzjL0j3Gw%2FL1shroGc0h2DPn7ahSaK5HCdbfXTkjjD0w%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
location
https://static.getbutton.io/widget/bundle.js
cf-ray
84f5e76d9e0535ea-FRA
2338552156985385749
www.blogger.com/feeds/6564966195710952198/posts/default/ 		141 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/feeds/6564966195710952198/posts/default/2338552156985385749?alt=json-in-script&callback=sqScripts
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
6d665c7c3b762d680011e775aeb690d7eecd0689be13b110d47b17153377b198
Security Headers
Name Value
Content-Security-Policy script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy
script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 23 Nov 2020 21:09:42 GMT
server
GSE
etag
W/"79085eae22a97a793a0cc9d55a712120ad0c1032e28ee245d2b4acaa8f5a9943"
p3p
CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
60195
x-xss-protection
1; mode=block
expires
Fri, 02 Feb 2024 22:34:52 GMT
7831596921262189508
www.blogger.com/feeds/6564966195710952198/posts/default/ 		43 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/feeds/6564966195710952198/posts/default/7831596921262189508?alt=json-in-script&callback=Icons
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
57c8e85a84dbea95b01883bd8a043aede953c8cb1047372daecbd39ab9762fa8
Security Headers
Name Value
Content-Security-Policy script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy
script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 31 Dec 2019 21:38:43 GMT
server
GSE
etag
W/"29e6f80dd6b4ae7327db07759b16063257b66eaa179ad508984870e32147168e"
p3p
CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11801
x-xss-protection
1; mode=block
expires
Fri, 02 Feb 2024 22:34:52 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 02 Feb 2024 21:48:09 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
2803
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 02 Feb 2024 23:48:09 GMT
vitals.js
www.chedmedturf1.com/tardisrocinante/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/tardisrocinante/vitals.js?gcb=0&cb=3
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b894147b763542f6c62b74227307d03261af5237a0cd149141af6066a28fec6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
50062
cf-polished
origSize=7941
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Fri, 02 Feb 2024 08:40:30 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TEUWdnv4yaJ%2BctM11%2B6aPfNlzyw4IJTb%2BdwQxgqLFE0EB8MRTrbkBRFxjaEkv1BstvWJu3Y8g5a6dakJBolC1fS7qAm3aetVEUkxWEc%2BwYE1r%2BXdV02sr87uWl2KneKavqyRp6gjR9FopewYByZpPP7WJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e76d49bb3671-FRA
drake.js
www.chedmedturf1.com/beardeddragon/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/beardeddragon/drake.js?gcb=0&cb=8
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e2e9642ce4893f96c168bd664e248170d5de361db3ae3a0280089d72b29dd20

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
9684
cf-polished
origSize=4247
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Fri, 02 Feb 2024 19:53:28 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NJLqn5Z8HejRCOnzM%2B8hiVc4mGcQqMvx%2FnvS6eabWKrj7mjZlimgGNI2a0mBWtPUZFXc5OvE2g%2BX%2BVA%2Fiu46Jt15cU1M04c4m237b044yzMROV1rsEbIvC49eJVQJj%2FuwiE6xIRX9bFP2%2FXqPVKB38eayQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e76d49bd3671-FRA
chanute.js
www.chedmedturf1.com/parsonsmaize/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/parsonsmaize/chanute.js?a=a&cb=9&dcb=195-0&shcb=34
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cb6666ac5ca730743eb9537dfb26940c88ffcbf6965a5122760a9d1e46a1503

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
706925
cf-polished
origSize=21786
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 25 Jan 2024 18:12:47 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Usk4PcGBT8PP%2Br0cgVouMH00dPnYYbtPInAiE8XCDP%2BoCgC9llj0AoMUC0WNqxWTcKu7LTl3MiBRZoBTpPFjQbjjnohCBWiS24Sx6MUVUCh4lqDy435fCCPHGQHa5C14PIpH4baZfzztVWIJ5K2GINo7sg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e76d49bf3671-FRA
jellyfish.js
www.chedmedturf1.com/porpoiseant/ 		37 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.chedmedturf1.com/porpoiseant/jellyfish.js?a=a&cb=13&dcb=195-0&shcb=34
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dab2243d88112f5900a8e0cf9c23ee92c5377b2b3e970a78873dbdde34570210

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/?m=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
706929
cf-polished
origSize=37616
x-middleton-display
sol-js
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Thu, 25 Jan 2024 18:12:43 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QBqxcT%2BIuEHPnZ0w0pSEV2tyHiex3yOKa7ur1%2BXcDhffsP2ENUYF4FxhfA8eBLqexPgxZPpuVCDQiZrChCgxiPvKIgx8Nr1gUQpyNaPfxWpfsT6rHa%2FW%2Fmqi%2F%2BoHYK9crFzj260batPbh5OQioCmXlHgDw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex
cf-ray
84f5e76d49c03671-FRA
adManager.m.js
js.wpadmngr.com/static/ 		102 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.wpadmngr.com/static/adManager.m.js
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
cf1ea6959e0327230e72f4d23dd42b2f328cb23203fbb18693a4d112e389497b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Fri, 02 Feb 2024 08:23:48 GMT
server
nginx/1.18.0
etag
W/"65bca694-199bb"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
c732c15639fcd926132918066c47dc70.js
51b8b4541b.4d15ee32c1.com/ 		102 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
cf1ea6959e0327230e72f4d23dd42b2f328cb23203fbb18693a4d112e389497b

Request headers

Referer
https://www.chedmedturf1.com/
Origin
https://www.chedmedturf1.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Fri, 02 Feb 2024 08:23:48 GMT
server
nginx/1.18.0
etag
W/"65bca694-199bb"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
muse.js
www.paypalobjects.com/muse/ 		55 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/muse/muse.js
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/tagmanager/pptm.js?id=www.chedmedturf1.com&t=xo&v=5.0.421&source=payments_sdk&client_id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&disableSetCookie=true&vault=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48DA) /
Resource Hash
20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
HIT
paypal-debug-id
f6d814f876e48
dc
ccg11-origin-www-1.paypal.com
content-length
16488
last-modified
Fri, 01 Sep 2023 21:10:59 GMT
server
ECAcc (ama/48DA)
traceparent
00-0000000000000000000f6d814f876e48-3a4475fefc58b336-01
etag
"64f25363-daa8"
vary
Accept-Encoding
content-type
application/javascript
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
expires
Fri, 02 Feb 2024 23:34:52 GMT
ts
t.paypal.com/ 		42 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3ATBLLRZVXR4VGQ-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3ATBLLRZVXR4VGQ-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=d4de756a-2b1c-4d3e-b8f2-8a7a868319a1&fltp=analytics&mrid=TBLLRZVXR4VGQ&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&flag_consume=yes&pt=chedmedturf&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1706913292372&g=-60&completeurl=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&disableSetCookie=true
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits
0, 0
date
Fri, 02 Feb 2024 22:34:52 GMT
via
1.1 varnish, 1.1 varnish
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
MISS, MISS
p3p
CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id
e9d6b3b223b09
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
x-served-by
cache-fra-eddf8230127-FRA, cache-ams21051-AMS
pragma
no-cache
correlation-id
e9d6b3b223b09
traceparent
00-0000000000000000000e9d6b3b223b09-237d677544620f27-01
x-timer
S1706913292.442966,VS0,VE172
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 02 Feb 2024 22:34:52 GMT
collect
region1.analytics.google.com/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-3QV3GWMZM4&gtm=45je41v0v876555216za200&_p=1706913292352&_gaz=1&gcd=11l1l1l1l1&npa=0&dma_cps=sypham&dma=1&tcfd=10001&cid=1155037991.1706913292&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1706913292&sct=1&seg=0&dl=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&dt=chedmedturf&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1414
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3QV3GWMZM4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-3QV3GWMZM4&cid=1155037991.1706913292&gtm=45je41v0v876555216za200&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&npa=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3QV3GWMZM4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.nl/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-3QV3GWMZM4&cid=1155037991.1706913292&gtm=45je41v0v876555216za200&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&npa=0&z=1296649212
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SLXGc1nY6HkvalIkTpu0xg.woff2
fonts.gstatic.com/s/cairo/v6/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cairo/v6/SLXGc1nY6HkvalIkTpu0xg.woff2
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf23098d0dceb8591e215a9ad2fa5a9c515b7c8e6877c1d0d3ec49b3d81231ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.chedmedturf1.com/
Origin
https://www.chedmedturf1.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Tue, 30 Jan 2024 19:01:33 GMT
x-content-type-options
nosniff
age
271999
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18044
x-xss-protection
0
last-modified
Wed, 17 Jul 2019 00:04:15 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Jan 2025 19:01:33 GMT
136573
na.nawpush.com/tags/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://na.nawpush.com/tags/136573?version_name=c
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.24 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
26390d1b40ad7c4968e698a3a317ab4b04ec46b1dc25b9f3831d1474d1bbd303

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Feb 2024 22:34:52 GMT
cache-control
max-age=300, public
content-type
application/json
server
nginx/1.18.0
content-length
1160
x-proxy-cache
HIT
advertising.js
js.capndr.com/ 		0
238 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.capndr.com/advertising.js
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Fri, 14 Jul 2023 08:23:25 GMT
server
nginx/1.18.0
etag
"64b105fd-0"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
accept-ranges
bytes
content-length
0
x-proxy-cache
HIT
91801
na.nawpush.com/tags/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://na.nawpush.com/tags/91801?version_name=c
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.24 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
9cc71ce40534de1480bc1dbb6b198d818e66946e3d2070d29fe3f7fa202047be

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Feb 2024 22:34:52 GMT
cache-control
max-age=300, public
content-type
application/json
server
nginx/1.18.0
x-proxy-cache
HIT
index.html
www.paypalobjects.com/muse/analytics/ Frame CA95 		55 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/muse/analytics/index.html
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/muse.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48B6) /
Resource Hash
7247ab83a30fbd92bf8425aca87dbb9f3f44c1b7facc6f7fd80df157ea6b5e03
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
cache-control
s-maxage=31536000, public,max-age=3600
content-encoding
gzip
content-length
16892
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
dc
ccg11-origin-www-1.paypal.com
etag
"64f25363-dacc"
expires
Fri, 02 Feb 2024 23:34:52 GMT
last-modified
Fri, 01 Sep 2023 21:10:59 GMT
paypal-debug-id
809ee2cd7b9d2
server
ECAcc (ama/48B6)
strict-transport-security
max-age=63072000; includeSubDomains; preload
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
traceparent
00-0000000000000000000809ee2cd7b9d2-6a5c833ca8c8eb92-01
vary
Accept-Encoding
x-cache
HIT
x-content-type-options
nosniff
collect
www.google-analytics.com/j/ 		4 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1405108102&t=pageview&_s=1&dl=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&ul=en-us&de=UTF-8&dt=chedmedturf&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IADAAEABAAAAACAAI~&jid=1131909025&gjid=763196539&cid=1155037991.1706913292&tid=UA-133826066-1&_gid=1318942207.1706913292&_r=1&_slc=1&z=107099705
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
91801
51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/91801?version_name=c
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
9cc71ce40534de1480bc1dbb6b198d818e66946e3d2070d29fe3f7fa202047be

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Feb 2024 22:34:52 GMT
cache-control
max-age=300
x-proxy-cache
HIT
server
nginx/1.18.0
content-type
application/json
expires
Fri, 02 Feb 2024 22:39:52 GMT
91801
51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/ 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/91801?version_name=c
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
9cc71ce40534de1480bc1dbb6b198d818e66946e3d2070d29fe3f7fa202047be

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Feb 2024 22:34:52 GMT
cache-control
max-age=300
x-proxy-cache
HIT
server
nginx/1.18.0
content-type
application/json
expires
Fri, 02 Feb 2024 22:39:52 GMT
137089
51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/21be37da1aa03150065a46617af00165/137089?version_name=c
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e10f9148bb40aecf301a9ada1e525a9d0be254512a9b4e4b0a3f56c8920d1c55

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.18.0
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=300
content-length
1157
x-proxy-cache
HIT
noop.js
www.paypalobjects.com/muse/ Frame CA95 		18 B
211 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.paypalobjects.com/muse/noop.js
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/analytics/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (daa/7D8C) /
Resource Hash
0739b17b1053de387d55795753300a79626787634f8c909277efff94d0e3f154
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.paypalobjects.com/muse/analytics/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
paypal-debug-id
4158a7e342e45
dc
ccg11-origin-www-1.paypal.com
content-length
18
last-modified
Sat, 13 Feb 2021 00:26:56 GMT
server
ECAcc (daa/7D8C)
traceparent
00-00000000000000000004158a7e342e45-d8bb74c586a1cd65-01
etag
"60271cd0-12"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
expires
Fri, 02 Feb 2024 22:34:51 GMT
ts
t.paypal.com/ 		42 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3ATBLLRZVXR4VGQ-1&page=muse%3Aoffer%3A%3A%3ATBLLRZVXR4VGQ-1%3A%3AvisitorInfoFlowStarted%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=d4de756a-2b1c-4d3e-b8f2-8a7a868319a1&es=visitorInfoFlowStarted&mrid=TBLLRZVXR4VGQ&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=chedmedturf&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1706913292503&g=-60&completeurl=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&disableSetCookie=true
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits
0, 0
date
Fri, 02 Feb 2024 22:34:52 GMT
via
1.1 varnish, 1.1 varnish
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
MISS, MISS
p3p
CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id
35140b59ac2c7
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
x-served-by
cache-fra-etou8220043-FRA, cache-ams21051-AMS
pragma
no-cache
correlation-id
35140b59ac2c7
traceparent
00-000000000000000000035140b59ac2c7-ab83288e306b19ee-01
x-timer
S1706913293.509615,VS0,VE169
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 02 Feb 2024 22:34:52 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
151 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-133826066-1&cid=1155037991.1706913292&jid=1131909025&gjid=763196539&_gid=1318942207.1706913292&_u=IADAAEAAAAAAACAAI~&z=1541883243
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 02 Feb 2024 22:34:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-133826066-1&cid=1155037991.1706913292&jid=1131909025&_u=IADAAEAAAAAAACAAI~&z=665597346
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.nl/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-133826066-1&cid=1155037991.1706913292&jid=1131909025&_u=IADAAEAAAAAAACAAI~&z=665597346
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
count.html
storage.multstorage.com/log/ Frame 8C3C 		882 B
705 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.multstorage.com/log/count.html
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:ae33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e76f1c370401-CDG
content-encoding
br
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Mon, 18 Sep 2023 14:39:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QHDyuf4TE1o91rJQ03ZkFwjWWFLbPxCsD8SR4ztOPNU0NdIYhAQB90utRbPDVyU7xUwkyPU5XUuCy265fY66NpeQu0mPtlLcsXZMrCYq0W6MwNsSJt23lYWaZMG%2Fus%2BT9nvPplxa2w9zY7ZmkoXRVxt2aa4HSg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-request-id
fe7879e1369bc0e35c497b6b75264f9e
track
fc07b36003.5b10f288ee.com/in/ 		0
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fc07b36003.5b10f288ee.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI2NTU2NTk4MzMzNzcyMTU3MDAwIiwidGltZXpvbmUiOjEsInZlciI6IjMuMTAyLjAiLCJ0YWdfaWQiOjEzNjU3Mywic2NyZWVuX3Jlc29sdXRpb24iOiIxNjAweDEyMDAiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IkV1cm9wZS9BbXN0ZXJkYW0iLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MC4xMiwiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiY2hlZG1lZHR1cmYlMkNjaGVkbWVkdHVyZiUyQ3F1aW50ZSUyQ3R1cmZvbyUyQ3F1aW50ZSUyQ2R1JTJDam91ciUyQ3RpZXJjZSUyQ3Byb25vc3RpYyUyQ3BtdSUyQ3F1aW50JUMzJUE5JTJDZHUlMkNqb3VyJTJDcG11JTJDcHJvbm9zdGljJTJDdHVyZiUyQ21hZ2lxdWUlMkNyb25vc3RpYyUyQ3F1aW50JUMzJUE5JTJDcG11JTJDZHUlMkNqb3VyJTJDIn0=
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.18.0
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
build.m.js
js.capndr.com/popunder-admanager/ 		92 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.capndr.com/popunder-admanager/build.m.js
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
2688f8be25920bf3bd64288ba7c750b941cc523e94218540bd624914d7f0ec82

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Thu, 01 Feb 2024 08:04:55 GMT
server
nginx/1.18.0
etag
W/"65bb50a7-16e9e"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
casquette.png
geoloc5.geovisite.ovh/skin/geocounter/ Frame B396 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://geoloc5.geovisite.ovh:4433/skin/geocounter/casquette.png
Requested by
Host: geoloc5.geovisite.ovh
URL: https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
lighttpd/1.4.54 /
Resource Hash
40ba84bac5d740e913d6c7035c8fe93eca31244fdb3564577c1af60847d1c262

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://geoloc5.geovisite.ovh/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Last-Modified
Tue, 14 Apr 2015 12:26:12 GMT
Server
lighttpd/1.4.54
ETag
"303213619"
Content-Type
image/png
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
4348
Expires
Sat, 17 Feb 2024 22:34:52 GMT
loupe30.png
geoloc5.geovisite.ovh/skin/png/ Frame B396 		30 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://geoloc5.geovisite.ovh:4433/skin/png/loupe30.png
Requested by
Host: geoloc5.geovisite.ovh
URL: https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
lighttpd/1.4.54 /
Resource Hash
9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://geoloc5.geovisite.ovh/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Last-Modified
Mon, 15 Jan 2007 09:45:09 GMT
Server
lighttpd/1.4.54
ETag
"3728015203"
Content-Type
image/png
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
31101
Expires
Sat, 17 Feb 2024 22:34:52 GMT
loupe30.cur
geoloc5.geovisite.ovh/skin/png/ Frame B396 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://geoloc5.geovisite.ovh:4433/skin/png/loupe30.cur
Requested by
Host: geoloc5.geovisite.ovh
URL: https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
lighttpd/1.4.54 /
Resource Hash
5f16ab826f87f46f60ad8c98c3bbed9a4273ff2da7843130b3036891251af5ed

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://geoloc5.geovisite.ovh/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Last-Modified
Thu, 16 Apr 2015 09:42:42 GMT
Server
lighttpd/1.4.54
ETag
"1268945244"
Content-Type
application/octet-stream
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
3782
Expires
Sat, 17 Feb 2024 22:34:52 GMT
globe.gif
geoloc5.geovisite.ovh/skin/geocounter/ Frame B396 		168 KB
168 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://geoloc5.geovisite.ovh:4433/skin/geocounter/globe.gif
Requested by
Host: geoloc5.geovisite.ovh
URL: https://geoloc5.geovisite.ovh/private/geocounter_iframe_css_64.php?compte=7pea4q23nt7b&anim=1&b=1&ca=990000&cbg=FFFFFF&dn=0&f=Verdana&fc=000000&onl=OnLine&p=_total&s=10&skin=1&tp=Click%20for%20detail&ts=150x170&ttot=7177740
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.36.176.112 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3092782.ip-54-36-176.eu
Software
lighttpd/1.4.54 /
Resource Hash
587cdcf764cce58883c13701fe36bdc1a68984555b6f1dc4540cc5e92217fcc2

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://geoloc5.geovisite.ovh/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Last-Modified
Tue, 28 Apr 2015 14:03:22 GMT
Server
lighttpd/1.4.54
ETag
"343773560"
Content-Type
image/gif
Cache-Control
max-age=1296000
Accept-Ranges
bytes
Content-Length
171894
Expires
Sat, 17 Feb 2024 22:34:52 GMT
truncated
/ Frame B396 		228 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9baaba7ad5ab74bbb9a0eb6ae6f7f0083a9ad93776dbf62c0e08d15bb010cb41

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/png
fp
fp.metricswpsh.com/ 		58 B
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=136573
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
58
fp
fp.metricswpsh.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=136573
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Connection
keep-alive
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
count.html
storage.multstorage.com/log/ Frame BB90 		882 B
712 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.multstorage.com/log/count.html
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:ae33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e76f1c390401-CDG
content-encoding
br
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Mon, 18 Sep 2023 14:39:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a0KpzEi%2FKiTPeZ06ST0jf8ojC1lR0MCA2g6yEIJ4cWGWxOMAnrq%2B6GLl5sHUEx3vjOXTiMPECY5mOfLGUY8aTOsHz%2B0ObXm2TXDyA0j%2F%2BYjDc52%2FHWYaCl3gqH2lys4asnyUECTCt7G4V9%2BhwDZGuT8esPoKcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-request-id
5280896c6570d498e47ac7f3bc166256
track
fc07b36003.5b10f288ee.com/in/ 		0
207 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fc07b36003.5b10f288ee.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI2NTU2NTk4MzMzNzcyMTU3MDAwIiwidGltZXpvbmUiOjEsInZlciI6IjMuMTAyLjAiLCJ0YWdfaWQiOjkxODAxLCJzY3JlZW5fcmVzb2x1dGlvbiI6IjE2MDB4MTIwMCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiRXVyb3BlL0Ftc3RlcmRhbSIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE1LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjAsInVzZXJfa2V5d29yZHMiOiJjaGVkbWVkdHVyZiUyQ2NoZWRtZWR0dXJmJTJDcXVpbnRlJTJDdHVyZm9vJTJDcXVpbnRlJTJDZHUlMkNqb3VyJTJDdGllcmNlJTJDcHJvbm9zdGljJTJDcG11JTJDcXVpbnQlQzMlQTklMkNkdSUyQ2pvdXIlMkNwbXUlMkNwcm9ub3N0aWMlMkN0dXJmJTJDbWFnaXF1ZSUyQ3Jvbm9zdGljJTJDcXVpbnQlQzMlQTklMkNwbXUlMkNkdSUyQ2pvdXIlMkMifQ==
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.18.0
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
push.m.js
js.wpshsdk.com/npc/sdk/ 		35 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.wpshsdk.com/npc/sdk/push.m.js?v=1
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
5d1bb3638edbf503bd2eba78fea24e47ae11c35b44b9f2c6fad05aae3967bd0f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Thu, 25 Jan 2024 13:00:03 GMT
server
nginx/1.18.0
etag
W/"65b25b53-8a00"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
npush.m.js
js.wpushsdk.com/npc/sdk/wpu/ 		160 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
ef6381bead0d2c23cc95edfeb5613d626735a4dc4c9c88421bcd4f9fe7cd85c8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Wed, 31 Jan 2024 12:28:08 GMT
server
nginx/1.18.0
etag
W/"65ba3cd8-2817d"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
fp
fp.metricswpsh.com/ 		58 B
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Requested by
Host: js.wpadmngr.com
URL: https://js.wpadmngr.com/static/adManager.m.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
58
fp
fp.metricswpsh.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Connection
keep-alive
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
count.html
storage.multstorage.com/log/ Frame D0F5 		882 B
709 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.multstorage.com/log/count.html
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:ae33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e76f1c3a0401-CDG
content-encoding
br
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Mon, 18 Sep 2023 14:39:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XxOLJDwxHk%2BFSaoTIA9vh%2Bh3jkj17GTnXvLWOw7meUzfWrep9WLX0CQlQYk%2Fe%2BnE7StZfGO9QgI8GRa0YoZUlTKcw9Mp9NMj4l21pEPOAWlkJYzoluNz14zINfNX2f2yMtOe4W1gQGF4pTOT1p1Axjmw2i35%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-request-id
4a3ca4b3d2aca262ed3ee9d59b1c204b
track
fc07b36003.5b10f288ee.com/in/ 		0
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fc07b36003.5b10f288ee.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI2NTU2NTk4MzMzNzcyMTU3MDAwIiwidGltZXpvbmUiOjEsInZlciI6IjMuMTAyLjAiLCJ0YWdfaWQiOjkxODAxLCJzY3JlZW5fcmVzb2x1dGlvbiI6IjE2MDB4MTIwMCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiRXVyb3BlL0Ftc3RlcmRhbSIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE2LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjAsInVzZXJfa2V5d29yZHMiOiJjaGVkbWVkdHVyZiUyQ2NoZWRtZWR0dXJmJTJDcXVpbnRlJTJDdHVyZm9vJTJDcXVpbnRlJTJDZHUlMkNqb3VyJTJDdGllcmNlJTJDcHJvbm9zdGljJTJDcG11JTJDcXVpbnQlQzMlQTklMkNkdSUyQ2pvdXIlMkNwbXUlMkNwcm9ub3N0aWMlMkN0dXJmJTJDbWFnaXF1ZSUyQ3Jvbm9zdGljJTJDcXVpbnQlQzMlQTklMkNwbXUlMkNkdSUyQ2pvdXIlMkMifQ==
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.18.0
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
e08c60c0a765b0cd8f36b179a2b1b910.js
51b8b4541b.4d15ee32c1.com/ 		92 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/e08c60c0a765b0cd8f36b179a2b1b910.js
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
2688f8be25920bf3bd64288ba7c750b941cc523e94218540bd624914d7f0ec82

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Thu, 01 Feb 2024 08:04:55 GMT
server
nginx/1.18.0
etag
W/"65bb50a7-16e9e"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
359fcd943ecbb2d7f76fe0719ec48e49.js
51b8b4541b.4d15ee32c1.com/ 		160 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/359fcd943ecbb2d7f76fe0719ec48e49.js
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
ef6381bead0d2c23cc95edfeb5613d626735a4dc4c9c88421bcd4f9fe7cd85c8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Wed, 31 Jan 2024 12:28:08 GMT
server
nginx/1.18.0
etag
W/"65ba3cd8-2817d"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
count.html
storage.multstorage.com/log/ Frame 4481 		882 B
704 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.multstorage.com/log/count.html
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:ae33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e76f1c3b0401-CDG
content-encoding
br
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Mon, 18 Sep 2023 14:39:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A5sm1u5Kc1WaEpSIHMDORMSjKugwgaaKsgKL8rRyP6w13UVlOO%2BTzBtes9NHOeFMvsBo6wpv6VGPIquPUmbb%2FDKQ62hJVZ5sgNtDsXQ7hrhtDe7a64zvLTlqFnWVYM4w1XRMhc8nwbPpddjhYNADehAN2p4BxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-request-id
393894c1b8e5ec9090d30d8d7c695026
track
fc07b36003.5b10f288ee.com/in/ 		0
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fc07b36003.5b10f288ee.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI2NTU2NTk4MzMzNzcyMTU3MDAwIiwidGltZXpvbmUiOjEsInZlciI6IjMuMTAyLjAiLCJ0YWdfaWQiOjkxODAxLCJzY3JlZW5fcmVzb2x1dGlvbiI6IjE2MDB4MTIwMCIsImFkYmxvY2siOjAsInRpbWV6b25lX29sc29uIjoiRXVyb3BlL0Ftc3RlcmRhbSIsInV0bV9zb3VyY2UiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJtbSI6MCwiaW5pdF9zdGFydF9sYXRlbmN5IjowLjE2LCJpc192MiI6MCwiaXNfdjJfZW1wdHkiOjAsInVzZXJfa2V5d29yZHMiOiJjaGVkbWVkdHVyZiUyQ2NoZWRtZWR0dXJmJTJDcXVpbnRlJTJDdHVyZm9vJTJDcXVpbnRlJTJDZHUlMkNqb3VyJTJDdGllcmNlJTJDcHJvbm9zdGljJTJDcG11JTJDcXVpbnQlQzMlQTklMkNkdSUyQ2pvdXIlMkNwbXUlMkNwcm9ub3N0aWMlMkN0dXJmJTJDbWFnaXF1ZSUyQ3Jvbm9zdGljJTJDcXVpbnQlQzMlQTklMkNwbXUlMkNkdSUyQ2pvdXIlMkMifQ==
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.18.0
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
count.html
storage.multstorage.com/log/ Frame F2AF 		882 B
911 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.multstorage.com/log/count.html
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:ae33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2

Request headers

Referer
https://www.chedmedturf1.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84f5e76f1c3c0401-CDG
content-encoding
br
content-type
text/html
date
Fri, 02 Feb 2024 22:34:52 GMT
last-modified
Mon, 18 Sep 2023 14:39:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lf%2B3t%2B6InaaCEzGR2KuyfWf%2F8Z64X%2BdJykqIz%2BHSzjDqcU3heL5XSp3Chd5fqwBq8Qjdqr0Lt%2Be960Heeympdi9dzNaj9SXAzZlIRClMWn9R6MOMbKMu6ZQJXUcFp6wUWd7RZYlfQ8NDTjD1C3n7k94%2B%2Bp3q0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-request-id
3c466d988489823b6d22dac3461c14f5
track
fc07b36003.5b10f288ee.com/in/ 		0
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fc07b36003.5b10f288ee.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI2NTU2NTk4MzMzNzcyMTU3MDAwIiwidGltZXpvbmUiOjEsInZlciI6IjMuMTAyLjAiLCJ0YWdfaWQiOjEzNzA4OSwic2NyZWVuX3Jlc29sdXRpb24iOiIxNjAweDEyMDAiLCJhZGJsb2NrIjowLCJ0aW1lem9uZV9vbHNvbiI6IkV1cm9wZS9BbXN0ZXJkYW0iLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MC4xNiwiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiY2hlZG1lZHR1cmYlMkNjaGVkbWVkdHVyZiUyQ3F1aW50ZSUyQ3R1cmZvbyUyQ3F1aW50ZSUyQ2R1JTJDam91ciUyQ3RpZXJjZSUyQ3Byb25vc3RpYyUyQ3BtdSUyQ3F1aW50JUMzJUE5JTJDZHUlMkNqb3VyJTJDcG11JTJDcHJvbm9zdGljJTJDdHVyZiUyQ21hZ2lxdWUlMkNyb25vc3RpYyUyQ3F1aW50JUMzJUE5JTJDcG11JTJDZHUlMkNqb3VyJTJDIn0=
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.20.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.20.2
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
fp
fp.metricswpsh.com/ 		58 B
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
58
fp
fp.metricswpsh.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Connection
keep-alive
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
fp
fp.metricswpsh.com/ 		58 B
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
58
fp
fp.metricswpsh.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=91801
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Connection
keep-alive
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
fp
fp.metricswpsh.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=137089
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Connection
keep-alive
Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
fp
fp.metricswpsh.com/ 		58 B
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fp.metricswpsh.com/fp?tag_id=137089
Requested by
Host: 51b8b4541b.4d15ee32c1.com
URL: https://51b8b4541b.4d15ee32c1.com/c732c15639fcd926132918066c47dc70.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
157.90.84.242 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.242.84.90.157.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Date
Fri, 02 Feb 2024 22:34:52 GMT
Server
nginx/1.20.1
Vary
Origin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.chedmedturf1.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
58
graphql
www.paypal.com/targeting/ Frame CA95 		443 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/targeting/graphql?disableSetCookie=true
Requested by
Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/muse/analytics/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b686ab45014c434ed19f7fb33dbc16afd4841c355176ea0f8a8a9847230e372b
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' https:; script-src 'nonce-QUIwflUByKa3dqPZk9/nY+EeAdLGhpG/kzG/xeWnb4ZmSPdi' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'none'; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.paypalobjects.com/
disable-set-cookie
true
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json

Response headers

content-security-policy
default-src 'self' https://*.paypal.com https://*.paypalobjects.com; img-src 'self' https:; script-src 'nonce-QUIwflUByKa3dqPZk9/nY+EeAdLGhpG/kzG/xeWnb4ZmSPdi' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' ; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'none'; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com;
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish
date
Fri, 02 Feb 2024 22:34:53 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
MISS, MISS, MISS
paypal-debug-id
f493038e0171a
server-timing
content-encoding;desc="gzip",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
x-xss-protection
1; mode=block
x-served-by
cache-fra-etou8220079-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f493038e0171a-5239c3c1acccbcd2-01
x-timer
S1706913293.914293,VS0,VE367
etag
W/"1bb-3QYN2WV8okE7vIVIH5eel/L8MKw"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.paypalobjects.com
access-control-expose-headers
Paypal-Debug-Id
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
bytes
x-cache-hits
0, 0, 0
graphql
www.paypal.com/targeting/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/targeting/graphql?disableSetCookie=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,disable-set-cookie
Access-Control-Request-Method
POST
Origin
https://www.paypalobjects.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-headers
content-type,disable-set-cookie
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
https://www.paypalobjects.com
access-control-expose-headers
Paypal-Debug-Id
cache-control
max-age=0, no-cache, no-store, must-revalidate
date
Fri, 02 Feb 2024 22:34:52 GMT
dc
ccg11-origin-www-1.paypal.com
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id
f4930383ec06d
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
traceparent
00-0000000000000000000f4930383ec06d-98a3ee21cf812c36-01
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, MISS, MISS
x-cache-hits
0, 0, 0
x-served-by
cache-fra-etou8220117-FRA, cache-ams21043-AMS, cache-ams21043-AMS
x-timer
S1706913293.711053,VS0,VE188
nmain.m.js
js.wpushsdk.com/skins/ 		435 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.wpushsdk.com/skins/nmain.m.js
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.52 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
d45dee2f35bf5e443d4d8f843c3a1c36a142f22035dac91b7dd93c3d923b5a81

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Thu, 01 Feb 2024 14:08:55 GMT
server
nginx/1.18.0
etag
W/"65bba5f7-6cdca"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
identifier
accounts.google.com/v3/signin/
Redirect Chain
  • https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
  • https://accounts.google.com/InteractiveLogin?continue=https://m.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=ASKXGp0_Pm8kqPokLlNK8LDbyG3xKcmN9jgR8Lom2vdqcMsBsuf6r7TPOyWOv...
  • https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp27Aj3obNFH8Q9mQ-4yeVHZF_SFJtNGdjUgOl16yQNEwkuBPDgiZPRFJ8kcVVhbM51Pv8qYVg&passive...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp27Aj3obNFH8Q9mQ-4yeVHZF_SFJtNGdjUgOl16yQNEwkuBPDgiZPRFJ8kcVVhbM51Pv8qYVg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S956928350%3A1706913292834087&theme=glif
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Server
2a00:1450:400c:c09::54 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Redirect headers

date
Fri, 02 Feb 2024 22:34:52 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-uUR4YbeZrIuhI1SfwegXWQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
402
x-xss-protection
1; mode=block
pragma
no-cache
server
GSE
x-frame-options
DENY
report-to
{"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type
text/html; charset=UTF-8
location
https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp27Aj3obNFH8Q9mQ-4yeVHZF_SFJtNGdjUgOl16yQNEwkuBPDgiZPRFJ8kcVVhbM51Pv8qYVg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S956928350%3A1706913292834087&theme=glif
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only
same-origin; report-to="coop_gse_qebhlk"
expires
Mon, 01 Jan 1990 00:00:00 GMT
dip
nereserv.com/in/ 		0
201 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nereserv.com/in/dip?site=native-push&wl=0&event_id=519ba76b-5fc3-4f86-b63b-23315a82358e&subid=623899809&sid=2400116532&spot_id=369790&created_at=2024-02-02&timezone=1&ver=8.138.1&is_native=1
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.235.163.216 Bühl, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.216.163.235.167.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
multy
990a2f6c18.b0624e3ea6.com/in/ 		38 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
56262a61cf139b588705c395fe11818b5cf0edff4103a70b1ff6fd65d3495b58

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
content-encoding
gzip
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
5494
multy
990a2f6c18.b0624e3ea6.com/in/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers
Content-Type
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
date
Fri, 02 Feb 2024 22:34:52 GMT
pragma
no-cache
server
nginx/1.20.1
vary
Origin
dip
nereserv.com/in/ 		0
200 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nereserv.com/in/dip?site=native-push&wl=0&event_id=ea343ffb-cce1-42a7-83db-e81df3ef224f&subid=623899809&sid=647602827&spot_id=369790&created_at=2024-02-02&timezone=1&ver=8.138.1&is_native=1
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.235.163.216 Bühl, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.216.163.235.167.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
4db8fdbc93265ecb324a4aac9050fe5e.js
51b8b4541b.4d15ee32c1.com/ 		435 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://51b8b4541b.4d15ee32c1.com/4db8fdbc93265ecb324a4aac9050fe5e.js
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.53 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
d45dee2f35bf5e443d4d8f843c3a1c36a142f22035dac91b7dd93c3d923b5a81

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 02 Feb 2024 22:39:52 GMT
date
Fri, 02 Feb 2024 22:34:52 GMT
content-encoding
gzip
last-modified
Thu, 01 Feb 2024 14:08:55 GMT
server
nginx/1.18.0
etag
W/"65bba5f7-6cdca"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
x-proxy-cache
HIT
multy
990a2f6c18.b0624e3ea6.com/in/ 		38 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
efb18973fadf11a095df8f8dec5ac16a8627a39c1b7108a0e7a8734728d01de8

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
content-encoding
gzip
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
5515
multy
990a2f6c18.b0624e3ea6.com/in/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers
Content-Type
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
date
Fri, 02 Feb 2024 22:34:52 GMT
pragma
no-cache
server
nginx/1.20.1
vary
Origin
dip
nereserv.com/in/ 		0
200 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://nereserv.com/in/dip?site=native-push&wl=0&event_id=b42c233c-5d50-4a83-aebd-cc29d518b7cb&subid=623899809&sid=1485811662&spot_id=369790&created_at=2024-02-02&timezone=1&ver=8.138.1&is_native=1
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.235.163.216 Bühl, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.216.163.235.167.clients.your-server.de
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:52 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
multy
990a2f6c18.b0624e3ea6.com/in/ 		38 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
34579733f30f2024a3cc8663d069a3f1e95e949082e991db76a20190ddcff885

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
content-encoding
gzip
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
5501
multy
990a2f6c18.b0624e3ea6.com/in/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://990a2f6c18.b0624e3ea6.com/in/multy
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers
Content-Type
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
date
Fri, 02 Feb 2024 22:34:52 GMT
pragma
no-cache
server
nginx/1.20.1
vary
Origin
4fd1cfcd-8cb0-44a4-8194-76ebc665a491
https://www.chedmedturf1.com/ 		204 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.chedmedturf1.com/4fd1cfcd-8cb0-44a4-8194-76ebc665a491
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
270fb9f71a35c9aac351e9fb4c18d5d8e7d2d40488bfc802b5bae62d3b133bee

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length
204
Content-Type
text/javascript
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: www.chedmedturf1.com
URL: https://www.chedmedturf1.com/?m=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.chedmedturf1.com/
Origin
https://www.chedmedturf1.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Fri, 02 Feb 2024 22:34:52 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
7331969
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QrW%2FG4kXCfd92KWjpRx9ADuYr6DLWuywrm88lncvzNfMwZeUCdRye8yqOisbdOhTDmam8x9tiZ9UJApXhxOOoEQQ8e%2B%2FuqqYwgva%2FHJdTGV7idrIz%2FUEBIhl2jxXS6TOthz1i9z6tXm3tCNnJqnN7fxp"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84f5e76fb95b37da-FRA
expires
Wed, 22 Jan 2025 22:34:52 GMT
js
www.paypal.com/sdk/ Frame 0CC7 		294 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
acf50b68bf1e14208d043310bb36ca773e8ac79c6519f4f8d7a2562791997459
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy
default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-OpIuqbmYBXstu5y4k/IVzRiUX65iJOgID5xBmq1O8jWqRoc8' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
content-encoding
gzip
x-content-type-options
nosniff
disable-set-cookie
true
via
1.1 varnish, 1.1 varnish, 1.1 varnish
date
Fri, 02 Feb 2024 22:34:52 GMT
age
4183
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
HIT, HIT, MISS
p3p
true
paypal-debug-id
f5553809429e8
server-timing
"traceparent;desc="00-0000000000000000000f5553809429e8-35f748c08092383c-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
content-length
80126
x-xss-protection
1; mode=block
x-served-by
cache-fra-eddf8230079-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f5553809429e8-f2a1a26dba887678-01
x-timer
S1706913293.758019,VS0,VE11
etag
W/"138fe-102c8G2EWCfaq4yNbgs9AIqF/Ms"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
Server-Timing
cache-control
public, max-age=3600, s-maxage=10800
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
bytes
x-cache-hits
4, 2, 0
truncated
/ Frame 0CC7 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 0CC7 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c4c2e6fd8a12889bc2ab350338566579ae079850e59701c8bf55ba52abd4d6b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
mcpuwpsh.com/get/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mcpuwpsh.com/get/
Requested by
Host: js.capndr.com
URL: https://js.capndr.com/popunder-admanager/build.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:c0:2306::1 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
8d5bcb38a90708a41221e80891b71fd29fc7fe63d7588a0ab43915a8f66a8fa9

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.16.0
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
4905
/
mcpuwpsh.com/get/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mcpuwpsh.com/get/
Requested by
Host: js.capndr.com
URL: https://js.capndr.com/popunder-admanager/build.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:c0:2306::1 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
731deeb179b095cafd4c48932c2f962cb96625566cc440914f59c5c330759ca7

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.16.0
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
5053
/
mcpuwpsh.com/get/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mcpuwpsh.com/get/
Requested by
Host: js.capndr.com
URL: https://js.capndr.com/popunder-admanager/build.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:c0:2306::1 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
04900336d2cb9743fb10cf0d1d53f196680de78b4fd8c62b8d4e4a3a5e884dab

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.16.0
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
5041
/
mcpuwpsh.com/get/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mcpuwpsh.com/get/
Requested by
Host: js.capndr.com
URL: https://js.capndr.com/popunder-admanager/build.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:c0:2306::1 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
466d3c37dcdac1d0cb3447dbf6de7bf0ab0795a6912da9a106b2182c66882b19

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.16.0
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
4905
/
mcpuwpsh.com/get/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mcpuwpsh.com/get/
Requested by
Host: js.capndr.com
URL: https://js.capndr.com/popunder-admanager/build.m.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:c0:2306::1 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
2839c222fdc2fa1866a8e9fa1a78b89a7ca191cc5f8c3e184747e0fd5fee813d

Request headers

Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.16.0
vary
Origin
access-control-allow-methods
*
content-type
application/json
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
4905
logger
www.paypal.com/xoplatform/logger/api/ Frame 0CC7 		1023 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
566e74a0fde705f312e04e1d943b2acf539648c137c61925d9061ea13b0d2656
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept
application/json
Referer
https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type
application/json

Response headers

date
Fri, 02 Feb 2024 22:34:53 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cache
MISS, MISS, MISS
paypal-debug-id
f4930388e1d4b
server-timing
content-encoding;desc="br",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
x-served-by
cache-fra-etou8220107-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f4930388e1d4b-12f1f323e47c09fc-01
x-timer
S1706913293.967765,VS0,VE257
etag
W/"3ff-nrmYx56diTXLWSNvSDJmLmJXhUQ"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.paypal.com
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
none
x-cache-hits
0, 0, 0
logger
www.paypal.com/xoplatform/logger/api/ 		1015 B
918 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/sdk/js?client-id=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&vault=true&intent=subscription
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6a96c2c4007b0a4f948423ecd299b561d168047d14e62627fdf570e116db5712
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept
application/json
Referer
https://www.chedmedturf1.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type
application/json

Response headers

date
Fri, 02 Feb 2024 22:34:53 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cache
MISS, MISS, MISS
paypal-debug-id
f493038b6111e
server-timing
content-encoding;desc="br",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
x-served-by
cache-fra-etou8220073-FRA, cache-ams21043-AMS, cache-ams21043-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f493038b6111e-76bec599a870e419-01
x-timer
S1706913293.185914,VS0,VE182
etag
W/"3f7-yWwFrOysEwIiOORsztGBoFvIzlw"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
none
x-cache-hits
0, 0, 0
logger
www.paypal.com/xoplatform/logger/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.chedmedturf1.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://www.chedmedturf1.com
cache-control
max-age=0, no-cache, no-store, must-revalidate
content-length
0
date
Fri, 02 Feb 2024 22:34:53 GMT
dc
ccg11-origin-www-1.paypal.com
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id
f493038bbb771
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
traceparent
00-0000000000000000000f493038bbb771-fbd67a35d04cf476-01
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
MISS, MISS, MISS
x-cache-hits
0, 0, 0
x-content-type-options
nosniff
x-served-by
cache-fra-eddf8230020-FRA, cache-ams21043-AMS, cache-ams21043-AMS
x-timer
S1706913293.977411,VS0,VE194
logger
www.paypal.com/xoplatform/logger/api/ Frame 0CC7 		1023 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.paypal.com/xoplatform/logger/api/logger?disableSetCookie=true
Requested by
Host: www.paypal.com
URL: https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.21 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
db2c84c449da973ae5bfed1c8e0bf974280a876a1a52dd674cbcf375692cba0a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.paypal.com/smart/buttons?style.label=subscribe&style.layout=vertical&style.color=gold&style.shape=rect&style.tagline=false&style.menuPlacement=below&sdkVersion=5.0.421&components.0=buttons&locale.country=US&locale.lang=en&sdkMeta=eyJ1cmwiOiJodHRwczovL3d3dy5wYXlwYWwuY29tL3Nkay9qcz9jbGllbnQtaWQ9QVQ2WEZMa0ZqdWxMbGdkRjJvNTUtQlhCMTJkc0kxVDFsWnRmZ3hjTzg4cmloTVhLc193dE81bFFCUkF6Z1BMX3Qzblk0QkFsWUtkaWpXRWQmdmF1bHQ9dHJ1ZSZpbnRlbnQ9c3Vic2NyaXB0aW9uIiwiYXR0cnMiOnsiZGF0YS1zZGstaW50ZWdyYXRpb24tc291cmNlIjoiYnV0dG9uLWZhY3RvcnkiLCJkYXRhLXVpZCI6InVpZF9tamhuYmR2dGpxc2VnaHppZXVvZWFidGh6anJsYmcifX0&clientID=AT6XFLkFjulLlgdF2o55-BXB12dsI1T1lZtfgxcO88rihMXKs_wtO5lQBRAzgPL_t3nY4BAlYKdijWEd&sdkCorrelationID=f761689e37455&storageID=uid_5f7ac97d84_mji6mzq6nti&sessionID=uid_0cc8376d8d_mji6mzq6nti&buttonSessionID=uid_fd340c7dc5_mji6mzq6nti&env=production&buttonSize=huge&fundingEligibility=eyJwYXlwYWwiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6ZmFsc2V9LCJwYXlsYXRlciI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2UsInByb2R1Y3RzIjp7InBheUluMyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhcmlhbnQiOm51bGx9LCJwYXlJbjQiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfSwicGF5bGF0ZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXJpYW50IjpudWxsfX19LCJjYXJkIjp7ImVsaWdpYmxlIjp0cnVlLCJicmFuZGVkIjp0cnVlLCJpbnN0YWxsbWVudHMiOmZhbHNlLCJ2ZW5kb3JzIjp7InZpc2EiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sIm1hc3RlcmNhcmQiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImFtZXgiOnsiZWxpZ2libGUiOnRydWUsInZhdWx0YWJsZSI6dHJ1ZX0sImRpc2NvdmVyIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiaGlwZXIiOnsiZWxpZ2libGUiOmZhbHNlLCJ2YXVsdGFibGUiOmZhbHNlfSwiZWxvIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfSwiamNiIjp7ImVsaWdpYmxlIjpmYWxzZSwidmF1bHRhYmxlIjp0cnVlfX0sImd1ZXN0RW5hYmxlZCI6ZmFsc2V9LCJ2ZW5tbyI6eyJlbGlnaWJsZSI6ZmFsc2UsInZhdWx0YWJsZSI6ZmFsc2V9LCJpdGF1Ijp7ImVsaWdpYmxlIjpmYWxzZX0sImNyZWRpdCI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJhcHBsZXBheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJzZXBhIjp7ImVsaWdpYmxlIjpmYWxzZX0sImlkZWFsIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJhbmNvbnRhY3QiOnsiZWxpZ2libGUiOmZhbHNlfSwiZ2lyb3BheSI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJlcHMiOnsiZWxpZ2libGUiOmZhbHNlfSwic29mb3J0Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm15YmFuayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJwMjQiOnsiZWxpZ2libGUiOmZhbHNlfSwid2VjaGF0cGF5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sInBheXUiOnsiZWxpZ2libGUiOmZhbHNlfSwiYmxpayI6eyJlbGlnaWJsZSI6ZmFsc2V9LCJ0cnVzdGx5Ijp7ImVsaWdpYmxlIjpmYWxzZX0sIm94eG8iOnsiZWxpZ2libGUiOmZhbHNlfSwiYm9sZXRvIjp7ImVsaWdpYmxlIjpmYWxzZX0sImJvbGV0b2JhbmNhcmlvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm1lcmNhZG9wYWdvIjp7ImVsaWdpYmxlIjpmYWxzZX0sIm11bHRpYmFuY28iOnsiZWxpZ2libGUiOmZhbHNlfSwic2F0aXNwYXkiOnsiZWxpZ2libGUiOmZhbHNlfSwicGFpZHkiOnsiZWxpZ2libGUiOmZhbHNlfX0&platform=desktop&experiment.enableVenmo=false&flow=subscription_setup&currency=USD&intent=subscription&commit=true&vault=true&renderedButtons.0=paypal&renderedButtons.1=card&clientMetadataID=uid_0cc8376d8d_mji6mzq6nti&debug=false&applePaySupport=false&supportsPopups=true&supportedNativeBrowser=false&allowBillingPayments=true&disableSetCookie=true
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 02 Feb 2024 22:34:53 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cache
MISS, MISS, MISS
paypal-debug-id
f493038c58186
server-timing
content-encoding;desc="br",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
x-served-by
cache-fra-etou8220106-FRA, cache-ams21082-AMS, cache-ams21082-AMS
accept-ch
sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent
00-0000000000000000000f493038c58186-5df7576c8780b405-01
x-timer
S1706913293.980256,VS0,VE226
etag
W/"3ff-EMTmVtMUekZEC488vJKw2HrPv5A"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.paypal.com
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy
ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges
none
x-cache-hits
0, 0, 0
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?display=swap&family=Roboto+Slab&family=Playfair+Display&family=Lora&family=Rubik&family=Fira+Sans&family=PT+Serif&family=Quicksand&family=Inter&family=Roboto&family=Open+Sans&family=Lato&family=Montserrat&family=Source+Sans+Pro&family=Roboto+Condensed&family=Oswald&family=Poppins&family=Roboto+Mono
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.chedmedturf1.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Tue, 30 Jan 2024 18:50:29 GMT
x-content-type-options
nosniff
age
272664
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Jan 2025 18:50:29 GMT
IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
static.bookmsg.com/creatives/IN/ 		790 B
1003 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=33b47d21-8542-4b7e-a346-4113438c06b5&prev_step_diff=447
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Sat, 01 Feb 2025 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
last-modified
Fri, 08 Dec 2023 10:18:03 GMT
server
nginx/1.24.0
etag
"6572ed5b-316"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
790
x-proxy-cache
HIT
IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
static.bookmsg.com/creatives/IN/ 		790 B
1003 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Sat, 01 Feb 2025 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
last-modified
Fri, 08 Dec 2023 10:18:03 GMT
server
nginx/1.24.0
etag
"6572ed5b-316"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
790
x-proxy-cache
HIT
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
201 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=2400116532&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&url=https%3A%2F%2Feu.moders.co%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1706913292805-4-9731-1316770-c38ee6d8-e955-f8c4-5d57-dc4aeebcda05&icons=pzvXPjMS81_lfQtJCqx1sNdKOBl8RV1tQoMtKeh5G_LgOfpO-icjYaUv-BNaFixYL4ERZjf8FP998Ujf477sJWunj0KxXYrg-dAM0fyGVW3wAKyMMRNjkMMNDYa2OlBhuoKN7-mauJTxAqKWtCkW95NrsdQkk0FaqKU8Q0lyNHQLBxTFVg&ext_cid=0&px_id=53369790&min_cpm=0.012121279267337404&out_id=1&campaign_type=lq-pop&aid=3251&cid=12972&uniq=d4628d4f7e93d1af9c47583bbbcf550d09032e7412ae4a1e2d019b8af7483838&mid=6645791315171074041&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.028153884333296828&cpm=0&verify_hash=f709ef153e86bf07db8e6614e529a711&is_native=2&real_bid=0.0003799955172312272&original_bid_usd=0.000453293&original_bid=0.000453293&exp=240&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=0,83,89,27,93,108&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=1706985292&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&site=native-push-mainstream&price=0.000453293&hostname=auc-inpage-hz-4-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.00000045329300000000003&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=236c31d9-94d6-49c3-9c7a-460619b58cb7&prev_step_diff=447
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
truncated
/ Frame B170 		483 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/ Frame B170
Redirect Chain
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyeayyfpbwxezl2jfavcb2hivhwdx3dgvpgm4dtpyaekwrmpjxx25ysgahsy2l5gj3usqkqa5froqjvir6ayi23mnmu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqoupjoffhu7p4lbac...
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
Protocol
H2
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
1cec85e404e543a8d14e8bc5aca13acdace8d4de8c0d8fe090dc2e51d6139969

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
9080
x-proxy-cache
HIT

Redirect headers

location
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
content-length
0
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=2400116532&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=6327533&crtid=17eee9e137531c6be8abb3f283760cb2&url=https%3A%2F%2Fs.viivideo.com%2Fh%2F2114%2Fm2weuqplr54vvmmjxtnxm46pskwn34wcxz3uukscozafqmdvezctzxexxtghcbj42blyuuw3kl5n6uhuk2uzy562gpzpf6gq4c22lwb7tbfdbolw7j5kqv2cvjzjngpjyvd2oqvu3ldk64pspkm5zdp7il6fet7dmn2ssd7ykrli64ktg3wrrncvikexo2vsohmjtytryjw7fox6jkewfzew4hgftgsbojno4tuq6gwoc7mvmgmhbgt3kgaes36gndojppgmohhu4uthp5zek2qhpzvh2zlqifdfob2eibawqrdzlnzvwz327fsxnjko3kap7wt2qezfxd2oqbejo7mkhkkxvwk2svbi2tmilore5cd7w5hesrvkizy6epvvlrgn6rtv4vtthutxwg54filpktvvcq5e7d2w4wvowrxvu4ttfakvejegjam4i2uxonzhqebq4jxzx22y7nek3zlfujeyxt2krfjbklrwgjrxmqawliduorcim5dxwdd7lbuhe7kuinncy6dgff2bonqfffuhbv2bod6wbx7l6b54c4sknzdgyuclieq663266vkf75ncnpzu6nswkr42i53vqwruvccswljzrfh736i234dw5vhfotdyjb4wcat5nb2wm5keizicff6mzkh43uhbtotfcy6juxfeogvkxcqim4alw3y7p625ep7ztonkoanhw4sqilpu45siem6rkb2xmvttkibhc47fgkjmgesskqc3afor6tki4f4ge3dw4cgl5zdhjvmeeskosxcxw47235igsxmu2lhfphxzffbws4cknydi2kr76yqesz45zmrtskkmdmrb2tbmimzg74ejmpfgzllp%3Fu%3Dhttps%253A%252F%252Fredirect.bestbsdatingservices.com%252F15GkWq%253Fplacement_id%253D1473389927411705%2526announcement_id%253D6327533%2526campaign_id%253D651622%2526cost%253D0.005%2526external_id%253Dcnv451c85560771b94894547f00a6de3d04&icons=6wZC8CyXqmRKvNkeVgK2ICL7fEtxBMBeXhKIexX0_HqtyLrEyW6FW7sV8wSkkGIuc_-XOj7OGRotFQp3volYVrvlzCrO5relJAdk8x92v4EhKSwJYaKi6unfLNPoP1leKIiCLnLWO4fOj9eRGj3NsgDgRiT6ckMomccNgJBDzftnb0pVdqsM_mdjlsPjKTFS07dkVqyMP9tk-c1bnQvESghokxxVMlM7lNTaGls12Mn7ke2JG8BLVzfqDRQjTq_31g3y1IGpiit3Y1xecdDgXMtv5GQcIvPlqUa1S6YzCJ7pgLTZ8wv5hoXKlG-MeFdK5HtiAt0k73l_2TJGpvfXlySYhc91K8ecKdVtAFr6yhDT8f0uqMfQvCClBxQoJkXOTqk5k5NuawC14F3EkuvgzOWP-p24gyAZWAJVsTvL7mzcsFXt_L1b_kV3vTc5k2XdcGhZuIT38x2o9vAVXruJBd-iupaD9t6kdLHgYfnfamyKLniTQFjN6c5TcgrrujILThd0uVkkk-v6oPNAkMWJQVDDsXkJVgqXjXnDj36QD08cxG0N69VIp9xEB-0TJW09PQ-P8skkUTmeXYdqhGaCputlBHfiKHl9si3LKDdNzSxnl9FHo6G5FaF6Eq37geaAp4jfzL-HOAA2XuiAnXLiZBHJQWO0Bo_tnTjXWQjt5jfhITJYkIotGSaQwomCuPRxEuryh27CVKmnHHtDES09GHkQ0eqskZ1uy0eaIa4zjF7Dc2-TeTzsyQCLtCAZ5dpP3-sfJ-EBnP354kJaFkN6C1RVs52hhu-y4RVLxGXtWuZp0ehOLuSsYJtFk218Ad1OsBwXVA1xtaYQpExXE_zCwz7aLGVcNRjmByxXafUp-cr1jFVLjqv3ZhqKZNOcXP_RnFCHHS17yBQk1nw4XwgJ7YH6gqjk0uOob64WSNupi88NswtrRtC7CVeYgyydRRh0Usfu9xANSGih-f0iocGDXnCNXVHoCA0CgGKf2kIwTneVhMcbSovY81Qd_RfFIjJQ4042nrm1WIBZZqwHJIgHC29xmM9oxX92mPu3sRpJHo3m5PM6wk48fKQ7izmKtri9bmEV1iFMgnVYpDmkwjVX8e-_xEmJMCwPCbb23AjvZ-s4eTcGKzBcPnK-jE9_mnHMOfaibstkSUGGKzxXpJmUg8aPKwENQNyJkOhgF1OwI5gDd_qML5yOxKdQCDOW4Ekh_E373EkjCtDJjK8Kox4yS9QTJIAZ1pWsIJTIOFMYKEFGTfteyGimI66m0AiH5PBYH9nygoZgl8V8y9aPqAJ4jpP9Gnl6nbg2edeUP0oD8CNtRFQ&ext_cid=651622&px_id=65022232&min_cpm=0.0009732092643071041&out_id=0&campaign_type=hq&aid=2055&cid=15863&uniq=&mid=6645791315171074041&skin_id=2&vertical_id=5&skin_test=0&from_cache=0&ecpm=0.017735866982292674&cpm=0&verify_hash=c2208e9fd38aa931010e6fa5b392653a&is_native=1&real_bid=0.0029814998854361652&original_bid_usd=0.0033499999251216657&original_bid=0.0033499999251216657&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=81,83,90,5&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F7533%2F533%2Frect_6351150b145e2t1666258187r6216.jpg.webp&site=native-push-mainstream&price=0.0033499999251216657&hostname=auc-inpage-hz-4-a&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.000003349999925121666&ext_campaign_id_str=651622&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=1ab1487c-feb0-468d-bea0-17ed3e5f8696&prev_step_diff=447
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
rect_6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/ Frame B170 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/rect_6351150b145e2t1666258187r6216.jpg.webp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
3151c6914dfaa08ce8ed67e524c8a98bb327044d71de484a1713ef4a319d99ea

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
16488
x-proxy-cache
HIT
IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
static.bookmsg.com/creatives/IN/ 		790 B
1004 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=4518adb9-67ee-4174-9d8f-c1cb69046417&prev_step_diff=460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Sat, 01 Feb 2025 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
last-modified
Fri, 08 Dec 2023 10:18:03 GMT
server
nginx/1.24.0
etag
"6572ed5b-316"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
790
x-proxy-cache
HIT
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=1485811662&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&url=https%3A%2F%2Feu.moders.co%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1706913292805-4-9731-1316770-ade0eccb-8fb2-2843-8222-ec2f66e371f8&icons=VWCAQwK9lbqgC_UlyTwIzatlluYFpO--5xdZfNHlzsdjDHGqvlrN3T8numaPMtPBct1QpU2z0OE0EMYdbi-IRAUUOziYU6KNzt5BGoeh5lrqEtugx28zuoJvKZ8a5no6zEj3F6DB7cfDA2KAjjykaBFLXww8QE21AASPPy86sEDxo9mrJQ&ext_cid=0&px_id=53369790&min_cpm=0.012121279267337404&out_id=1&campaign_type=lq-pop&aid=3251&cid=12972&uniq=d4628d4f7e93d1af9c47583bbbcf550d09032e7412ae4a1e2d019b8af7483838&mid=1726051598738058315&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.028228105403947133&cpm=0&verify_hash=7f66defec3ca525f624a4c4eae73e53c&is_native=2&real_bid=0.00038099728571891906&original_bid_usd=0.000454488&original_bid=0.000454488&exp=240&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=108,0,83,89,27,93&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=1706985292&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&site=native-push-mainstream&price=0.000454488&hostname=auc-inpage-hz-0-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.000000454488&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=0320bda9-98bf-468e-9993-328e2e52148f&prev_step_diff=460
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
rect_6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/ Frame 67FC 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/rect_6351150b145e2t1666258187r6216.jpg.webp
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
3151c6914dfaa08ce8ed67e524c8a98bb327044d71de484a1713ef4a319d99ea

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
16488
x-proxy-cache
HIT
truncated
/ Frame 67FC 		483 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/ Frame 67FC
Redirect Chain
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyeoyyopzxxeyl2i5afmc2aivhgjgfr37rwm4d6frluixt6feycw4qxg4bx223qmn5esqksk4ieatzrjb6vu7qom5mu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqo3g6l3e4k737lbac...
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
Protocol
H2
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
1cec85e404e543a8d14e8bc5aca13acdace8d4de8c0d8fe090dc2e51d6139969

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
9080
x-proxy-cache
HIT

Redirect headers

location
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
content-length
0
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=1485811662&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=6327533&crtid=17eee9e137531c6be8abb3f283760cb2&url=https%3A%2F%2Fs.viivideo.com%2Fh%2F2114%2Fm2weuqplr54vvmmjxtnxm46pskwn34wcxz3uukscozafqmdvezctzxexxtghcbj72blyuuw3kl5n6uhuk2uzy562gpzpf6gq4c22lwb7tbfdbolw7j5kqv2cvjzjngpjyvd2oqvu3ldk64pspkm5zdp7il6fet7dmn2ssd7ykrli64ktg3wrrncvikexo2vsohmjtytryjw7fox6jkewfzew4hgftgsbojno4tuq6gwoc7mvmglxbgt3kgaes36gndojppgmohhu4uthp5zek2qhpzvh2zlxifgvcbkeirawmrl6k52fwzt77fsxnjko23aixudsqezfxpkm6zezq7mkhksxtekxszbistv3lkuefbl4w5hesrvkizy6epvvlrgn6rtv4vtthutxwg54filpktvfcq5e7d2w4wvowrxvu4ttfakvejegjam4i2uxonzhqebq4jxzx22y7nek3zlfujeyxt2krfjbklrwgjqherataqarora5gmjh6wlwlnssuk2zifkxekjtoequky2tfe5snv2bod6wbx7l6b54c4sknzdgyuclieq663266vkf75ncnpzu6nswkr42i53vqwruvccsuxc7d6ux22bo2zpxnflfey2cjbbgodtymb2wm5khi5zk3iu7ucj67q5trrwxrs4n3rot3kfgx2geck6trlrootrxu3zjd4gkrwgypl3rejwwitcy7jaxw3yfhy6cm4tnlqyf4kb4fezcobiacbkegxa3h4oxkxxxmr4es6pnvomoottmpvfhes7lzjigjg6rpfmgrzorzfg7z6yrkv7wyuclbgaa2gpvbfueffpqezdsmzymimjwkhlwinwppeybzbklw6i%3D%3Fu%3Dhttps%253A%252F%252Fredirect.bestbsdatingservices.com%252F15GkWq%253Fplacement_id%253D1473389927411705%2526announcement_id%253D6327533%2526campaign_id%253D651622%2526cost%253D0.005%2526external_id%253Dcnv715ff3e6ecb57075ab8688ae9c60edcb&icons=ernV5dg8_obc8n9Z551m50afv3CHApfIP_Adyl6rSDJ9sOmqa8Iy7C4ZIDnUT3h1EFtgC4O2VT1XaGwK1jNZlpbtlu8wpHKAHiaJ-5MePg8athFMqIimqeSgB-vM5NO5ArGPQOVHURcgVMJC68jDG6_Xx-y5boToExXtemiiErCXR1gJyF9PaDXr-OYU5Iq-HrMUuyO4JhBmZ5ZUvaW3FKbQFRYBAWd2lCn3mqRJSkKEEEZRjpNKT52AvV1K5gDbxEURaLU9v5cqt78bX8VB9SUf4G1wNal5C43504DyEXKtbDkHFpb8jV5Ohucwq7oGIMy_wZjXWdnNpNfHCe-SaLJPLDY_chxyVGlLihcsH5JhRJyyJ0zlsjerStKMXQ3OHABqdOIa5DCt1gkyspOJIzhrZi_iAKaHMHS1mpXikK0RCJhc50wkdzY18YM5qWBLQSyEWLs2ep-gb-8lKkND8nRiq0TkIT-lTO4Ebb1IOH8fVjZfsfjP0GnnloA-pT40Je-B5Qk9hRwU-z5gj9fTFN8jZU8Ok_5XXf1RlynSImEfptAZ-7XiarWzGr54_gorvNdSvkWxoA4ES_ks8uXGR60g5imvgAOKftHO7FGkB8XU1NmxyL5rCqQZ5UtHtZo97Rvy0U46f09tLg4-eLOVvtmNxD9ie3xOQt28qW_dnkZZxxV45HvuJ8iunpBwhEcEAvHuySzxegI8HQr-MAVpv6cR6AoLsKErVWOGVBlgSlH3MoCRrSeWX2uMoXf8-Z6YZtbm2Ylkty3S36Irjx2hfbM-ZYBWrr4qQW70Q_laVQZlWq69MV9twzEEX9WbXKAtoA_ymHL-CBjxh3nlEJkX8-TZpnFD50OLHdlDi8jlpoA1C8ZielRJhEvuA0L9gdlh9guEeKU6RGZK_LIsjAatYMMh2wvsk9dDkvE3J5V3fTIDErcXz_WD4MV-bjJQfWOHKhaEQiZQmh25q_ptfpIyzjOOdU7awWFlliYBkRyGzjaKR-lEi63mspzrnU-dYnKdLEONrUPugvQMbcZTkcsaK0yITWW65Djq50ZO8t_ts4mKOL_R1H1lwmDJ7MozZvsdykAd6M5xM4raKzQUaRFvitZXbynIwqTQzGgP_jIRbwMUPPUXkx9wIPLJ9Sq0z0VGtJW2dTdSEuCCfbVb8aT_hbklgpUvkYetxfjnMJ172IwAUecQ2OvTUaUIDmC4p9-DXCxGdqeJdQvYAzcznWEPlHl0CXJQkxJQ8QW_1RZlo2j6sW0yzC6ztVxyQrMoog4b_aULJCHf6fwF8oPb18YUENJd7rwvlb67Dxkm_8zZe7R8B9o&ext_cid=651622&px_id=65022232&min_cpm=0.0009732092643071041&out_id=0&campaign_type=hq&aid=2055&cid=15863&uniq=&mid=1726051598738058315&skin_id=2&vertical_id=5&skin_test=0&from_cache=0&ecpm=0.017735866982292674&cpm=0&verify_hash=23f8eb0eee0d4a49698c1ce975ac8ad3&is_native=1&real_bid=0.0029814998854361652&original_bid_usd=0.0033499999251216657&original_bid=0.0033499999251216657&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=5,81,83,90&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F7533%2F533%2Frect_6351150b145e2t1666258187r6216.jpg.webp&site=native-push-mainstream&price=0.0033499999251216657&hostname=auc-inpage-hz-0-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.000003349999925121666&ext_campaign_id_str=651622&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=7a393ac0-8b52-454f-a45c-3d061cd2ae88&prev_step_diff=460
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
ts
t.paypal.com/ 		42 B
249 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.paypal.com/ts?pgrp=muse%3Aoffer%3A%3A%3ATBLLRZVXR4VGQ-1&page=muse%3Aoffer%3A%3A%3ATBLLRZVXR4VGQ-1%3A%3AvisitorInfo%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=d4de756a-2b1c-4d3e-b8f2-8a7a868319a1&es=visitorInfo&cust=identified&mrid=TBLLRZVXR4VGQ&code=CHECKOUT_BUTTON&partner_name=CHECKOUT_BUTTON&pt=chedmedturf&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&unsc=8&identifier_used=DFP&e=im&t=1706913293291&g=-60&completeurl=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&disableSetCookie=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.35 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits
0, 0
date
Fri, 02 Feb 2024 22:34:53 GMT
via
1.1 varnish, 1.1 varnish
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
MISS, MISS
p3p
CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id
4acfd7b54bf5d
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
x-served-by
cache-fra-eddf8230037-FRA, cache-ams21051-AMS
pragma
no-cache
correlation-id
4acfd7b54bf5d
traceparent
00-00000000000000000004acfd7b54bf5d-19558b2abb080afa-01
x-timer
S1706913293.297314,VS0,VE169
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=0, no-cache, no-store, must-revalidate
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 02 Feb 2024 22:34:53 GMT
IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
static.bookmsg.com/creatives/IN/ 		790 B
1003 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Sat, 01 Feb 2025 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
last-modified
Fri, 08 Dec 2023 10:18:03 GMT
server
nginx/1.24.0
etag
"6572ed5b-316"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
790
x-proxy-cache
HIT
IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp
static.bookmsg.com/creatives/IN/ 		790 B
1003 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.bookmsg.com/creatives/IN/IN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp?pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=9f73adc0-704e-40bc-8922-1c6bfa08d26a&prev_step_diff=618
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:b48:8301::24 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Sat, 01 Feb 2025 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
last-modified
Fri, 08 Dec 2023 10:18:03 GMT
server
nginx/1.24.0
etag
"6572ed5b-316"
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
790
x-proxy-cache
HIT
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=647602827&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=&crtid=41e2b054b7d7fdd561f6651d06d511e5&url=https%3A%2F%2Feu.karoon.xyz%2Fnty%2Fpostback%2Fclick%3Fkey%3Dv2-1706913292934-4-9731-1316770-0b0cf8a4-447d-f28c-b63b-bbb6f13f25c6&icons=55MOQCwb4nrKbwsUFO6E_LCN6sLWCZ7FR2Dr66VjMGwXKrx7IXODxtDAW4HbDWZaMMwB1L4oHRwL8T2bTuYnjFt6mp91NMg0jAm9gPemOXjMaer7gU75GQS9-d_zylVM27uYVXwA8yHWvRhYUQShmdSx1hvbiLwcIxpL8OEVUVPN6WtouQ&ext_cid=0&px_id=53369790&min_cpm=0.012121279267337404&out_id=1&campaign_type=lq-pop&aid=3251&cid=12972&uniq=d4628d4f7e93d1af9c47583bbbcf550d09032e7412ae4a1e2d019b8af7483838&mid=5262970551527670241&skin_id=2&vertical_id=0&skin_test=0&from_cache=0&ecpm=0.026517294198036914&cpm=0&verify_hash=1728a1ff135dd697a0bf5d40757acc14&is_native=2&real_bid=0.0003579063125026237&original_bid_usd=0.000426943&original_bid=0.000426943&exp=240&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=93,108,0,83,89,27&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=1706985292&image_url=https%3A%2F%2Fstatic.bookmsg.com%2Fcreatives%2FIN%2FIN_da5b583487923e03a815871465a0b6f24c2cb005_icon.webp&site=native-push-mainstream&price=0.000426943&hostname=auc-inpage-hz-5-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.00000042694299999999996&ext_campaign_id_str=&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&mlf=1&mlc=1&st=0.01&cpa=f0e3cfdd-b3b2-4738-a325-218220b13e56&prev_step_diff=618
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0
rect_6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/ Frame 70EE 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/492x328/q85/image/vk/7533/533/rect_6351150b145e2t1666258187r6216.jpg.webp
Requested by
Host: js.wpushsdk.com
URL: https://js.wpushsdk.com/npc/sdk/wpu/npush.m.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
3151c6914dfaa08ce8ed67e524c8a98bb327044d71de484a1713ef4a319d99ea

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
16488
x-proxy-cache
HIT
truncated
/ Frame 70EE 		483 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type
image/svg+xml
6351150b145e2t1666258187r6216.jpg.webp
i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/ Frame 70EE
Redirect Chain
  • https://s.viivideo.com/n/2114/ozihu7srifkhw63eofyea2qopruheztsinbvkacfjjgwt7xxuwmwm4bnficbcwtzprscsiyrmmcs6pjgmb2esrs2bikbislbiv6qu4c4mrmu4v2el56x2zl3ll42witnugn2hwtuivtau6rcxjacquqox7w4rdo432p5dds...
  • https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
Protocol
H2
Server
45.133.44.37 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.23.2 /
Resource Hash
1cec85e404e543a8d14e8bc5aca13acdace8d4de8c0d8fe090dc2e51d6139969

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires
Fri, 16 Feb 2024 22:34:53 GMT
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
x-cache-status
MISS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=1209600
content-length
9080
x-proxy-cache
HIT

Redirect headers

location
https://i.cdnfimgs.com/auto/192/q85/image/vk/7533/533/6351150b145e2t1666258187r6216.jpg.webp
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.23.2
content-length
0
/
990a2f6c18.b0624e3ea6.com/in/show/ 		0
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://990a2f6c18.b0624e3ea6.com/in/show/?tag_ab=c&site_id=31369790&adblock=0&testab=0&auction_host=&mm=0&yc=0&render_type=hq&pr=&banner_width=300&banner_height=100&user_keywords=&device_theme=light&v2_track=0&v2=0&conditions=dch_ip&ssp=3964&page=https%3A%2F%2Fwww.chedmedturf1.com%2F%3Fm%3D1&refdom=www.chedmedturf1.com&auction_time=1706913292&subid=623899809&sid=647602827&tcid=0&ver=8.138.1&ver_c=&spot_id=369790&utm_source=&utm_medium=&utm_campaign=&utm_content=&created_at=2024-02-02&iabcat=IAB9-30&keywords=&user_fp=12450226470614798260&score=62.166133459083674&durl=https%3A%2F%2Fkts.dasdaily.com%2Fin%2F1546%2F%3Fad_sub%3D623899809%26spot_id%3D369790%26is_adult%3D0%26p%3Dhttps%253A%252F%252Fwww.chedmedturf1.com%252F%253Fm%253D1%26idzone%3D0%26sid%3D1885&is_cpm=0&resp_type=&crid=6327533&crtid=17eee9e137531c6be8abb3f283760cb2&url=https%3A%2F%2Fs.viivideo.com%2Fh%2F2114%2Fm2weuqplr54vvmmjxtnxm46pskwn34wcxz3uukscozafqmdvezctzxexxtghcbjv2blyuuw3kl5n6uhuk2uzy562gpzpf6gq4c22lwb7tbfdbolw7j5kqv2cvjzjngpjyvd2oqvu3ldk64pspkm5zdp7il6fet7dmn2ssd7ykrli64ktg3wrrncvikexo2vsohmjtytryjw7fox6jkewfzew4hgftgsbojno4tuq6gwoc7mvmg6xbgt3kgaes36gndojppgmohhu4uthp5zek2qhpzvh2zlqjbgvgaseinewert5lryvizls7fsxnjko36v5n3l4qezfxpkmqbejm7odhclhtekxszbimtv3lkredat4w5hesrvkizy6epvvlrgn6rtv4vtthutxwg54filpktvfcq5e7d2w4wvowrxvu4ttfakvejegjam4i2uxonzhqebq4jxzx22y7nek3zlfujeyxt2krfjbklrwgi3hkrkfanlroqsamukxqdbdlftxukcsciecq6jspaqrmyqpfy6hbv2bod6wbx7l6b54c4sknzdgyuclieq663266vkf75ncnpzu6nswkr42i53vqwruvccsski2lz7guk53odxxnfpveyscjncwoal3nb3g64kgmwn3h2vu5xxzr5vki5cnbd7ujmty7jfasjfrv47pthzfejhv5wjz3hwnrwgyouiyjfggmzhbinjxshyzhy4gyz3nca5vgkjveeztobahaqbvyeixhvhxvx2oirjhxrn5qlaey4tdibbwxdvriv4irrkllr73leoji7knwk3rk5dgyualvanqhuqlozoj7qigejoxeecqa5lrsyitft3zskpin2pvc%3D%3D%3D%3Fu%3Dhttps%253A%252F%252Fredirect.bestbsdatingservices.com%252F15GkWq%253Fplacement_id%253D1473389927411705%2526announcement_id%253D6327533%2526campaign_id%253D651622%2526cost%253D0.005%2526external_id%253Dcnva640aee085e2be571a3eeb1d0ce19cd4&icons=zpbC0IAGbxs8_xQe7uwe6Zz6RZKybXh0dJX9TQRhvSgJnoNCPRZWrzs-8g9zZZziRLLc7EurBaBtvg4q89x4pwq0hYH-MmrLvWaEbJ4o6cZzSrS-qvBDQMOAK9DCn4u66EULHQ-C9is_9THEH-TJLbk_MfY_-A6bgPu6v7SnPy1O8tgGpRjrGfgPXLLovGI2vRxsU0nTryd1Dcu8uIpuT6SHnPc-zPQz-SL5jC4vQ6Ob-yCNzahzDav5UQ-JYHjkjAKtu6BqF6HnVx0gVr3J1cO3kRYzuNECrBYRkx90NJbYX1dJQ46xDYVJjyz1_CsFtkKLVy5b0TinSBDjklyJIo7ilm-a3tRGoT3H5sO1JgXPCMyyMerQFCFPC7p2YE2mc3FTjnhb2bM6DcWnafxo3B2NVwf1TUXY6p3xFF6CwvMFK2aV-WduqrFni9z-Z7Ug9s2lJUodCQRc-tGlJtd3KTEeEFUJ_3x0yctPlMMmE_ggmYTJqS3a0m-9vT1MQ6hRdb3UmWllQJKeCPEg-6ROlytAoObRvtXZNdn9rDnkN8XHpt79HsaVwtWtlLRy0gsS0OZw2wR60eUdBPwod8LKi9ZIvULvjiWm3MpTSZCRg6TgyGvM4e9I_PTDZ2bSdS8rXASOoyLBkiIcVaErnHPN2rgon6ThspcP7OBOLQsXJvcTWhzXzR1zF3KGfTCFTy6XEkeG2F25YXpfbFcDq8UMXIfNE35LD9aCW9FfHxP0rlm4SRRZCNeMxE4Dt97pyrh8wDMbHmvY6I3GGF7Vx0o3su6ycpqTy-MJAPCD4Kn24xPYvTzQTj00G0DC3NAS1981-O9E9kRTX_KzfxeqedQYQ1vYqQ4S0ddKqx4Og-Q7oye_HctHGw_wPTDS6UzmP9NnKZh-r5F4Z1kpvQvaPygW_E8_DgRWXjZjKyo3pdE5ivEtrY26qWR2FnuaXYvLqlUyMTkUIDFoQXubS8jggwG1WF_-_8KgrKUxrxRlL-Df2bDFi_kf8q-wEQBsVknUErNci-qOq7iMn6RHdBvDhH4GnmTqvYp6eEMDapnYDNXMNKi4ZC6IMYLjGgPZH7_YQGt1VDnz3RGoL9BeLYEoLUhpMZHtoKrdpp-uH2uNfJNSsNRWsClbik2wZf_mR0wSM6VlY-0QlLsdxeqmcVk6mrRomjqHSCzI7wOSotxod_B5-bX49N4re-u_JQyuW3J1chn2Lrza_V2sZf-9y8IeA2O47yHPNVy0wT7VD8xRXp02C-Cq2_RNhjxgUdVpl8bcwqNu3G9fOJcXJuof2mjLbUwvL6yJz7TMAnAcdEIWiEWgDJOTH-c&ext_cid=651622&px_id=65022232&min_cpm=0.0009732092643071041&out_id=0&campaign_type=hq&aid=2055&cid=15863&uniq=&mid=5262970551527670241&skin_id=2&vertical_id=5&skin_test=0&from_cache=0&ecpm=0.017735866982292674&cpm=0&verify_hash=872a6aea2d9b323bff997b6d4e74dc3d&is_native=1&real_bid=0.0029814998854361652&original_bid_usd=0.0033499999251216657&original_bid=0.0033499999251216657&exp=0&placement_type_id=0&ua_mismatch=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F121.0.6167.139%20Safari%2F537.36&ip_mismatch=2001:1af8:4700:a08a:4::5&geo=NL&carrier=-&label_ids=83,90,5,81&need_redirect_show=0&applied_features=prod,main-skins-settings&show_count=1&expiration_timestamp=0&image_url=https%3A%2F%2Fi.cdnfimgs.com%2Fauto%2F492x328%2Fq85%2Fimage%2Fvk%2F7533%2F533%2Frect_6351150b145e2t1666258187r6216.jpg.webp&site=native-push-mainstream&price=0.0033499999251216657&hostname=auc-inpage-hz-5-b&auc_type=1&pop_type=1&site_id64=&interest_vertical_ids=&mo=&ve=&timezone_olson=Europe/Amsterdam&topics=&historical_keywords=&pop_cpc=0.000003349999925121666&ext_campaign_id_str=651622&pattern1=0&pattern2=0&pattern3=0&pattern4=0&pattern5=0&format=default-view-t_r-body&st=0.01&cpa=b10f5632-1330-46ee-8cc4-bd9e49933ecc&prev_step_diff=618
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:4f8:1060:13eb::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.chedmedturf1.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Feb 2024 22:34:53 GMT
server
nginx/1.20.1
vary
Origin
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-transform, no-cache, no-store, must-revalidate
access-control-allow-headers
Content-Type
content-length
0

Verdicts & Comments Add Verdict or Comment

205 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 function| __tcfapi string| _ez_ab_test object| __ezHttpConsent object| ezTcfConsent function| getEzConsentData function| _setEzCookies object| __ez object| _ezaq object| adsbygoogle string| ezoTemplate string| ezouid string| ezoFormfactor string| soc_app_id number| did string| ezdomain number| ezoicSearchable string| _ezExtraQueries function| create_ezolpl function| attach_ezolpl function| __setCMPv2RequestData object| _CMPv2RequestData boolean| cmpIsOn number| PostCount object| _bl object| AuthorsInfo object| SqCmz object| atOptions undefined| hREED function| getEzErrorURL function| reportEzError function| __ezDotData function| setImmediate function| clearImmediate object| nunjucksPrecompiled boolean| ezStandaloneCmp number| ez_tos_track_count number| ez_last_activity_count object| __ezCmpConfig object| ezCMP string| compte string| platform string| name_browser string| version function| getCookieVal function| GetCookie function| EcrireCookieGeo number| nb_couleur number| browser string| resolution object| date_geoloc undefined| reg string| ref string| url string| page undefined| reg2 undefined| couleur_lib undefined| logo_lib undefined| compteur_lib undefined| categorie_lib undefined| defautgif string| md5 number| date_test string| outils2geocounter3 string| bool_refresh object| tab_urlp number| datep function| refreshpiiiii function| detectFlash2 function| detectFlash2iiiiii undefined| iversion function| chrome_flash_redraw string| base_url string| base_gmt object| geonb string| langue number| dateloc string| page_stat object| tab string| p_geocounter3 object| __post_robot_11_0_0___uid_mjhnbdvtjqseghzieuoeabthzjrlbg object| paypal object| __zoid_10_3_3___uid_mjhnbdvtjqseghzieuoeabthzjrlbg function| R function| X function| gtag object| dataLayer object| google object| trans string| AltImage string| AltAuthor number| snippetLength boolean| showAuthor boolean| showTimestamp string| LinkCopied string| showMore string| BlogLang string| BlogDirection string| JumpButton string| CanUrl string| HomeUrl boolean| FeedEnabled boolean| isPrivate boolean| httpsEnabled boolean| isHomepage boolean| isArchive boolean| isMultipleItems boolean| isSingleItem boolean| isPage boolean| isPost string| blogId string| itemId boolean| isStorage object| a function| b object| TransLabels number| tr function| popUp object| SubMitems number| si object| MainMitems number| mi object| item object| SubMenus undefined| ul object| MegaItems number| gi string| label object| WidsHead number| wh undefined| head undefined| headTitle undefined| Nums undefined| newTitle object| PostLinks function| resizeImg function| LazyImages undefined| style function| GetScriptsAndIcons function| sqScripts function| Icons number| pl string| GoogleAnalyticsObject function| ga string| _audins_dom number| _audins_did undefined| __ez_dims function| _emitEzConsentEvent boolean| ezgconsent object| google_tag_manager object| google_tag_data function| $ function| jQuery object| paypalDDL string| PaypalOffersObject function| ppq object| googletag function| onYouTubeIframeAPIReady object| gaGlobal object| metricNameMap function| ezlogVital object| webVitals object| __adFormats object| __formatsGetters object| _admSptsInVw object| AdManager object| a3klsam function| initEzux function| ez_attachEvent function| ez_attachEventWithCapture function| ez_detachEvent function| ez_getQueryString object| riveted object| ezux object| ct object| ezdent object| ezDenty object| ezua object| ezuxgoals object| _ezfd object| __post_robot_10_0_44__ object| PAYPAL object| gaplugins object| gaData object| WhWidgetSendButton function| getRemoteSubscriber function| init object| activesInpages function| __fp-init object| popunderMetricsForSurvey object| __inpageSkins number| feed_count object| perf_vals

9 Cookies

Domain/Path Name / Value
.chedmedturf1.com/ Name: _ga_3QV3GWMZM4
Value: GS1.1.1706913292.1.0.1706913292.60.0.0
.chedmedturf1.com/ Name: _ga
Value: GA1.2.1155037991.1706913292
.chedmedturf1.com/ Name: _gid
Value: GA1.2.1318942207.1706913292
.chedmedturf1.com/ Name: _gat_blogger
Value: 1
.paypal.com/ Name: tsrce
Value: smartcomponentnodeweb
.paypal.com/ Name: l7_az
Value: dcg15.slc
.paypal.com/ Name: ts
Value: vreXpYrS%3D1801607692%26vteXpYrS%3D1706915092%26vr%3D6bf5e0a918d0a798103b0951fb6702d6%26vt%3D6bf5e0a918d0a798103b0951fb6702d5%26vtyp%3Dnew
.paypal.com/ Name: ts_c
Value: vr%3D6bf5e0a918d0a798103b0951fb6702d6%26vt%3D6bf5e0a918d0a798103b0951fb6702d5
fp.metricswpsh.com/ Name: id
Value: 7136803729663367028

35 Console Messages

Source Level URL
Text
javascript warning URL: https://www.chedmedturf1.com/?m=1(Line 1612)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://intellectualhide.com/68cb2163d05db9b977f8cdf4713d58a5/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.chedmedturf1.com/?m=1(Line 1612)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://intellectualhide.com/68cb2163d05db9b977f8cdf4713d58a5/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://intellectualhide.com/68cb2163d05db9b977f8cdf4713d58a5/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: https://intellectualhide.com/5b/b7/9d/5bb79dc1f95d0cdbe2931d863feafbd2.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
network error URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fm.youtube.com%2Ffavicon.ico&hl=en&ifkv=ASKXGp27Aj3obNFH8Q9mQ-4yeVHZF_SFJtNGdjUgOl16yQNEwkuBPDgiZPRFJ8kcVVhbM51Pv8qYVg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S956928350%3A1706913292834087&theme=glif
Message:
Failed to load resource: the server responded with a status of 403 ()
network error
Message:
A bad HTTP response code (404) was received when fetching the script.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.chedmedturf1.com/?m=1
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3.bp.blogspot.com
51b8b4541b.4d15ee32c1.com
990a2f6c18.b0624e3ea6.com
accounts.google.com
blogger.googleusercontent.com
cdnjs.cloudflare.com
fc07b36003.5b10f288ee.com
fonts.googleapis.com
fonts.gstatic.com
fp.metricswpsh.com
geoloc5.geovisite.ovh
i.cdnfimgs.com
img.root-top.com
intellectualhide.com
js.capndr.com
js.wpadmngr.com
js.wpshsdk.com
js.wpushsdk.com
mcpuwpsh.com
na.nawpush.com
nereserv.com
privacy.gatekeeperconsent.com
region1.analytics.google.com
s.viivideo.com
static.bookmsg.com
static.getbutton.io
stats.g.doubleclick.net
storage.multstorage.com
t.paypal.com
the.gatekeeperconsent.com
www.blogger.com
www.chedmedturf1.com
www.google-analytics.com
www.google.com
www.google.nl
www.googletagmanager.com
www.gstatic.com
www.paypal.com
www.paypalobjects.com
151.101.129.21
151.101.193.35
157.90.84.242
167.235.163.216
172.240.108.68
192.229.221.25
2001:4860:4802:32::36
2606:4700:20::681a:fdd
2606:4700:3031::ac43:c7ba
2606:4700:3032::ac43:ae33
2606:4700:3038::6815:ea1b
2606:4700::6811:180e
2a00:1450:4001:806::2003
2a00:1450:4001:80e::2001
2a00:1450:4001:80e::2009
2a00:1450:4001:810::2008
2a00:1450:4001:828::2003
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::200e
2a00:1450:4001:831::2001
2a00:1450:400c:c00::9b
2a00:1450:400c:c09::54
2a01:4f8:1060:13eb::2
2a01:4f8:c0:2306::1
2a02:b48:8301::24
2a06:98c1:3120::3
31.220.27.135
45.133.44.24
45.133.44.37
45.133.44.52
45.133.44.53
54.36.176.112
04900336d2cb9743fb10cf0d1d53f196680de78b4fd8c62b8d4e4a3a5e884dab
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0739b17b1053de387d55795753300a79626787634f8c909277efff94d0e3f154
122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787
12ee6ccaa9b562aa22df51c93464d0bc483dd35ed9eef40d9e7cd8b06c609b4f
1c4c2e6fd8a12889bc2ab350338566579ae079850e59701c8bf55ba52abd4d6b
1cec85e404e543a8d14e8bc5aca13acdace8d4de8c0d8fe090dc2e51d6139969
1d7a77f24fc31abf310ccb240b2e0a49f2582823f990eef11a3abc37f286ea12
20029e526c0674dd1f99d02142bbf324bd8ee217ca43705fa6fe1a64bd90ee0c
25b02175cc0a4e36fda24db4b7de40009feb7b31f18fe3c77423a2169929b94b
26390d1b40ad7c4968e698a3a317ab4b04ec46b1dc25b9f3831d1474d1bbd303
2688f8be25920bf3bd64288ba7c750b941cc523e94218540bd624914d7f0ec82
270fb9f71a35c9aac351e9fb4c18d5d8e7d2d40488bfc802b5bae62d3b133bee
2839c222fdc2fa1866a8e9fa1a78b89a7ca191cc5f8c3e184747e0fd5fee813d
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487
3151c6914dfaa08ce8ed67e524c8a98bb327044d71de484a1713ef4a319d99ea
3207e72919c552725824c188790c2d997094c1faa1019bf5b55abfb4216babc7
34579733f30f2024a3cc8663d069a3f1e95e949082e991db76a20190ddcff885
369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c
3e95dbe814ec64151e2a610cbed23b66909cb781c0ab20b6fa026f3e0f71f227
40ba84bac5d740e913d6c7035c8fe93eca31244fdb3564577c1af60847d1c262
444a68f8495f8630e1a536a36db8f87ae01cc45e59a3ebf341e1568cc0904cf0
4559f063977072488f6dd2c96ff11fa2dbfc62c9e26d1b8c2c80c48a85964ecc
466d3c37dcdac1d0cb3447dbf6de7bf0ab0795a6912da9a106b2182c66882b19
470e34af8480c28b69c721fad6fb484b48658adbda73d3425c7e4d2fd8493b84
47af11196f463dc4b43db4eedc61bcfe8498fa40112ae681218b7cad7b242f46
49632c68007b262c89478dff0cbda5c8dc983ddaee1cb3725a3eb9a924f62150
498f22cc18a63857f7b415eb9872e54236582d2a25a4dc5614302a2207e76d42
4b894147b763542f6c62b74227307d03261af5237a0cd149141af6066a28fec6
4fc468991137d09453f90b5b4573f0f575db6721ae6c1cb3efc4818931561166
52a543aadcbc40f2d90d859fe30a36ed78b2df0bbfc0ae64c6a989f5f38fa06d
56262a61cf139b588705c395fe11818b5cf0edff4103a70b1ff6fd65d3495b58
563f9dcb6f5643dcf54839299ecbba4d6523792b1f25ac6475162f0400884f93
566e74a0fde705f312e04e1d943b2acf539648c137c61925d9061ea13b0d2656
57c8e85a84dbea95b01883bd8a043aede953c8cb1047372daecbd39ab9762fa8
587cdcf764cce58883c13701fe36bdc1a68984555b6f1dc4540cc5e92217fcc2
597b8d67ab1ae1248dc69b6ef66b49d95eedc1ab74ae74234d86e3668d72e58e
5cb3d6eb9c192f0339126dc9290c8cdc286512f79318d9a6e5033b2ebb93e8cd
5d1bb3638edbf503bd2eba78fea24e47ae11c35b44b9f2c6fad05aae3967bd0f
5f16ab826f87f46f60ad8c98c3bbed9a4273ff2da7843130b3036891251af5ed
6065f8f718670e4deec4ee9f2b5b65da4af0e7f3d52522dbfb264c4b2a1db31a
628dd66807d3b2d412155fbac40f7144cb811db30fc25ba3e79efee1ae9e6c67
6a96c2c4007b0a4f948423ecd299b561d168047d14e62627fdf570e116db5712
6d665c7c3b762d680011e775aeb690d7eecd0689be13b110d47b17153377b198
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6e8e676aa36b985b06d8c29ee0fc9741de544c35abe7c9dc4e77f51c8558b0ff
7247ab83a30fbd92bf8425aca87dbb9f3f44c1b7facc6f7fd80df157ea6b5e03
731deeb179b095cafd4c48932c2f962cb96625566cc440914f59c5c330759ca7
756c4b07ecaf70170ca6800deaa650bc4c001d54314e454cb1776fc6240d62a0
7bb15ee4e4f34c369ca83927f2ac810093e6a024c5c362f7cbf681aa22a18b7d
86e721bb96c71af08a282151a6246606d325447fc603947cffb628265d7509be
8a7b1ca4bbf273b32ea865d4785a1944d1b2b133678d9b5fe7ee0406f6fd64b2
8cb6666ac5ca730743eb9537dfb26940c88ffcbf6965a5122760a9d1e46a1503
8d5bcb38a90708a41221e80891b71fd29fc7fe63d7588a0ab43915a8f66a8fa9
8e2e9642ce4893f96c168bd664e248170d5de361db3ae3a0280089d72b29dd20
99acd5216966bf76b323ddb9635c1be6ab8556b95520aaf61224eb0bb8320919
9baaba7ad5ab74bbb9a0eb6ae6f7f0083a9ad93776dbf62c0e08d15bb010cb41
9cc71ce40534de1480bc1dbb6b198d818e66946e3d2070d29fe3f7fa202047be
9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460
9eb09d55e3e9208799d2aa988208d5931dfcd92008e095729c50ac13865b4e94
9fba7686001b516b0414bef328255eca729f278c1d14d324c8567733426439a5
acf50b68bf1e14208d043310bb36ca773e8ac79c6519f4f8d7a2562791997459
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b686ab45014c434ed19f7fb33dbc16afd4841c355176ea0f8a8a9847230e372b
b78c5c3f93b9d9d8dcb46d08d4f67cbcf71ff8b2ec96c03543fc377ce446b6e6
c81f39c34f1b76539d5bd5944c808c67ea754d7e354caa9a616072d8fa5036b5
cd6484138e1413538458fbd847afaec9a519420805d94c9465af927acb643275
cf1ea6959e0327230e72f4d23dd42b2f328cb23203fbb18693a4d112e389497b
cf23098d0dceb8591e215a9ad2fa5a9c515b7c8e6877c1d0d3ec49b3d81231ae
d0a0701b182bd4986bf16d3796251c0db1d92c6f8487866e6f6bbbd81cd1a3dd
d45dee2f35bf5e443d4d8f843c3a1c36a142f22035dac91b7dd93c3d923b5a81
d9af49c10c5a8062e5fde477550c3669bdbd09fc5b9d6eee319e808740744e7d
da3db5db384db589fcb253a7544b8b5124a488de54e9e41947529a0018257dee
dab2243d88112f5900a8e0cf9c23ee92c5377b2b3e970a78873dbdde34570210
db2c84c449da973ae5bfed1c8e0bf974280a876a1a52dd674cbcf375692cba0a
dccb2b98943fa6b1c7bbc0d631efa07d7f0eea5873fed74a09bb77ffbc30410a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e10f9148bb40aecf301a9ada1e525a9d0be254512a9b4e4b0a3f56c8920d1c55
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b2784385cd128d5a6dfdec7f4be2147d6b57fa66c1a36c61c085aaf27f9e18
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef478ed80c13ec32ae90c53076046c928ac583d3520b92d94a2c9aa2c42f71fc
ef6381bead0d2c23cc95edfeb5613d626735a4dc4c9c88421bcd4f9fe7cd85c8
efb18973fadf11a095df8f8dec5ac16a8627a39c1b7108a0e7a8734728d01de8
f00d6a10bc408d02d701a790cf5a528df1868f4c39316daef39c7ed4241d506b
f66e281a1c148d2ca48792ca323dab41f372e3e22bb4a452a740c5c7b0ba9195
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615