www.spokesman.com Open in urlscan Pro
18.245.86.10 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Submission: On May 11 via api (May 11th 2025, 5:19:17 am UTC) from US — Scanned from PL

Summary HTTP 292 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 71 IPs in 7 countries across 61 domains to perform 292 HTTP transactions. The main IP is 18.245.86.10, located in United States and belongs to AMAZON-02, US. The main domain is www.spokesman.com. The Cisco Umbrella rank of the primary domain is 313873.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 29th 2025. Valid for: a year.

This is the only time www.spokesman.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	18.245.86.10 18.245.86.10	16509 (AMAZON-02) (AMAZON-02)
8	52.222.236.129 52.222.236.129	16509 (AMAZON-02) (AMAZON-02)
8	3.161.82.61 3.161.82.61	16509 (AMAZON-02) (AMAZON-02)
6	172.217.18.8 172.217.18.8	15169 (GOOGLE) (GOOGLE)
1	13.35.58.95 13.35.58.95	16509 (AMAZON-02) (AMAZON-02)
4	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
3	13.35.58.11 13.35.58.11	16509 (AMAZON-02) (AMAZON-02)
1	104.20.36.218 104.20.36.218	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.19.220.32 104.19.220.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.18.24.90 104.18.24.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.18.14 172.217.18.14	15169 (GOOGLE) (GOOGLE)
6	216.58.206.78 216.58.206.78	15169 (GOOGLE) (GOOGLE)
1 2	107.178.250.234 107.178.250.234	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.198.218.70 34.198.218.70	14618 (AMAZON-AES) (AMAZON-AES)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	216.239.32.36 216.239.32.36	15169 (GOOGLE) (GOOGLE)
2	108.177.15.155 108.177.15.155	15169 (GOOGLE) (GOOGLE)
1	142.250.186.131 142.250.186.131	15169 (GOOGLE) (GOOGLE)
1 13	104.20.37.218 104.20.37.218	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	13.107.246.53 13.107.246.53	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
9	44.218.68.176 44.218.68.176	14618 (AMAZON-AES) (AMAZON-AES)
5	18.159.212.21 18.159.212.21	16509 (AMAZON-02) (AMAZON-02)
2	52.209.86.237 52.209.86.237	16509 (AMAZON-02) (AMAZON-02)
2	63.215.202.146 63.215.202.146	41041 (VCLK-EU-S...) (VCLK-EU-SE Conversant LLC)
5	89.149.192.192 89.149.192.192	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.)
5	152.42.155.191 152.42.155.191	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	185.89.210.122 185.89.210.122	29990 (ASN-APPNEX) (ASN-APPNEX)
2	178.250.1.38 178.250.1.38	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
2	34.1.1.166 34.1.1.166	15169 (GOOGLE) (GOOGLE)
3	143.244.197.139 143.244.197.139	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	34.120.63.153 34.120.63.153	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 3	163.5.194.37 163.5.194.37	60558 (SECUREDSE...) (SECUREDSERVERS-EU PHOENIX NAP)
2	52.222.136.15 52.222.136.15	16509 (AMAZON-02) (AMAZON-02)
1	13.107.246.64 13.107.246.64	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
53	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
2	142.250.186.129 142.250.186.129	15169 (GOOGLE) (GOOGLE)
4	52.26.0.221 52.26.0.221	16509 (AMAZON-02) (AMAZON-02)
5	142.250.184.193 142.250.184.193	15169 (GOOGLE) (GOOGLE)
1 2	104.18.94.41 104.18.94.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
33	104.26.2.180 104.26.2.180	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	216.58.212.170 216.58.212.170	15169 (GOOGLE) (GOOGLE)
12	172.64.147.188 172.64.147.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
3	13.32.99.78 13.32.99.78	16509 (AMAZON-02) (AMAZON-02)
1	13.33.187.112 13.33.187.112	16509 (AMAZON-02) (AMAZON-02)
4	151.101.2.133 151.101.2.133	54113 (FASTLY) (FASTLY)
1	104.16.79.73 104.16.79.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.26.5.15 104.26.5.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.110 142.250.185.110	15169 (GOOGLE) (GOOGLE)
1	16.15.179.180 16.15.179.180	14618 (AMAZON-AES) (AMAZON-AES)
2	13.85.16.224 13.85.16.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	54.90.36.212 54.90.36.212	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	35.227.203.93 35.227.203.93	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	20.50.88.242 20.50.88.242	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	142.250.185.97 142.250.185.97	15169 (GOOGLE) (GOOGLE)
1	20.60.62.4 20.60.62.4	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2.19.216.27 2.19.216.27	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.213.31.160 52.213.31.160	16509 (AMAZON-02) (AMAZON-02)
1	34.224.66.164 34.224.66.164	14618 (AMAZON-AES) (AMAZON-AES)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1	35.214.136.108 35.214.136.108	19527 (GOOGLE-2) (GOOGLE-2)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
1	52.217.115.232 52.217.115.232	16509 (AMAZON-02) (AMAZON-02)
3	157.240.251.35 157.240.251.35	32934 (FACEBOOK) (FACEBOOK)
1	18.66.122.118 18.66.122.118	16509 (AMAZON-02) (AMAZON-02)
2	18.66.122.115 18.66.122.115	16509 (AMAZON-02) (AMAZON-02)
1	2.22.242.114 2.22.242.114	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	18.173.205.12 18.173.205.12	() ()
292	71

1 18.245.86.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-10.fra60.r.cloudfront.net

www.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.222.236.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-129.fra56.r.cloudfront.net

thumb.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.161.82.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-82-61.fra56.r.cloudfront.net

static.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.18.8 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.58.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-95.fra60.r.cloudfront.net

cdn-gateflipp.flippback.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.35.58.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-11.fra60.r.cloudfront.net

prod.adspsp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.36.218 (None, )

ASN13335 (CLOUDFLARENET, US)

widgets.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.220.32 (None, )

ASN13335 (CLOUDFLARENET, US)

sdk.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.18.24.90 (None, )

ASN13335 (CLOUDFLARENET, US)

events.newsroom.bi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.14 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 216.58.206.78 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.198.218.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-198-218-70.compute-1.amazonaws.com

p.flipp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 216.239.32.36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.177.15.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wr-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net

www.google.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.20.37.218 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.107.246.53 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cdn.wgchrrammzv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.q0losid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.a3kvau184uea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.sy57d8wi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.e3fbosf1tz3d.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.pranmcpkx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 44.218.68.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-68-176.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.159.212.21 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.209.86.237 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-86-237.eu-west-1.compute.amazonaws.com

hb.minutemedia-prebid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.215.202.146 (Amsterdam, Netherlands)

ASN41041 (VCLK-EU-SE Conversant LLC, US)
PTR: ams01-convex-float1.dotomi.com

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 89.149.192.192 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL)

prg.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.42.155.191 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

exchange.kueezrtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.122 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.38 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

grid-bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.1.1.166 (Paris, France)

ASN15169 (GOOGLE, US)
PTR: 166.1.1.34.bc.googleusercontent.com

hb-api.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 143.244.197.139 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.63.153 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 153.63.120.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 163.5.194.37 (Amsterdam, Netherlands) 1 redirects

ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.136.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-136-15.fra50.r.cloudfront.net

hb.yellowblue.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.246.64 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

53 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.129 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f1.1e100.net

438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.26.0.221 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-26-0-221.us-west-2.compute.amazonaws.com

adspsp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.184.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.94.41 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 104.26.2.180 (None, )

ASN13335 (CLOUDFLARENET, US)

givebuttercdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.212.170 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f10.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.64.147.188 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.99.78 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-78.fra60.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.187.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-112.fra60.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.2.133 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.braintreegateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.79.73 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.5.15 (None, )

ASN13335 (CLOUDFLARENET, US)

api-mg2.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 16.15.179.180 (United States)

ASN14618 (AMAZON-AES, US)

paywall-ad-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-spokesman-proxy-connext.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.90.36.212 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-90-36-212.compute-1.amazonaws.com

ph.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.203.93 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 93.203.227.35.bc.googleusercontent.com

pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.50.88.242 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.97 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f1.1e100.net

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.60.62.4 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prodmg2.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.216.27 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-216-27.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.31.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-31-160.eu-west-1.compute.amazonaws.com

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.224.66.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-66-164.compute-1.amazonaws.com

ssp.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.136.108 (Groningen, Netherlands)

ASN19527 (GOOGLE-2, US)
PTR: 108.136.214.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.217.115.232 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.251.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-118.fra60.r.cloudfront.net

media.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.122.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-115.fra60.r.cloudfront.net

media.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.22.242.114 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-22-242-114.deploy.static.akamaitechnologies.com

code.createjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.205.12 (None, )

ASN- ()

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 121 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 178	447 KB
33	givebuttercdn.com givebuttercdn.com — Cisco Umbrella Rank: 138103	928 KB
20	givebutter.com 1 redirects widgets.givebutter.com — Cisco Umbrella Rank: 69010 givebutter.com — Cisco Umbrella Rank: 50471 js.givebutter.com — Cisco Umbrella Rank: 157697 ph.givebutter.com — Cisco Umbrella Rank: 143017	592 KB
20	spokesman.com www.spokesman.com — Cisco Umbrella Rank: 313873 thumb.spokesman.com — Cisco Umbrella Rank: 274006 static.spokesman.com — Cisco Umbrella Rank: 350332 media.spokesman.com — Cisco Umbrella Rank: 346809	1 MB
12	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 2247 ka-p.fontawesome.com — Cisco Umbrella Rank: 3595	34 KB
11	matheranalytics.com 1 redirects js.matheranalytics.com — Cisco Umbrella Rank: 17121 www.i.matheranalytics.com — Cisco Umbrella Rank: 16131	45 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 59	43 KB
7	adspsp.com prod.adspsp.com — Cisco Umbrella Rank: 29334 adspsp.com — Cisco Umbrella Rank: 25631	151 KB
6	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 750 region1.analytics.google.com — Cisco Umbrella Rank: 4582	10 KB
6	newsroom.bi events.newsroom.bi — Cisco Umbrella Rank: 6498	2 KB
6	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 259 stats.g.doubleclick.net — Cisco Umbrella Rank: 171	224 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 58	669 KB
5	kueezrtb.com exchange.kueezrtb.com — Cisco Umbrella Rank: 2378	372 B
5	smartadserver.com prg.smartadserver.com — Cisco Umbrella Rank: 1895	2 KB
5	sharethrough.com btlr.sharethrough.com — Cisco Umbrella Rank: 1168	617 B
4	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 428 ep2.adtrafficquality.google — Cisco Umbrella Rank: 438	25 KB
4	braintreegateway.com js.braintreegateway.com — Cisco Umbrella Rank: 9099	58 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 215	158 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 505	264 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	213 B
3	stripe.com js.stripe.com — Cisco Umbrella Rank: 1231 m.stripe.com Failed	179 KB
3	e3fbosf1tz3d.xyz cdn.e3fbosf1tz3d.xyz — Cisco Umbrella Rank: 35724	641 KB
3	a-mo.net 1 redirects prebid.a-mo.net — Cisco Umbrella Rank: 836	298 B
3	media.net prebid.media.net — Cisco Umbrella Rank: 1120 cs.media.net — Cisco Umbrella Rank: 1017	2 KB
3	servenobid.com ads.servenobid.com — Cisco Umbrella Rank: 3316	2 KB
3	criteo.com grid-bidder.criteo.com — Cisco Umbrella Rank: 1215 dis.criteo.com — Cisco Umbrella Rank: 832	1 KB
2	stripe.network m.stripe.network	16 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 738	519 B
2	azurewebsites.net prod-spokesman-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 460308	1 KB
2	amazonaws.com paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 49035 s3.amazonaws.com	141 KB
2	cloudflare.com 1 redirects challenges.cloudflare.com — Cisco Umbrella Rank: 2199	16 KB
2	yellowblue.io hb.yellowblue.io — Cisco Umbrella Rank: 1644	1 KB
2	omnitagjs.com hb-api.omnitagjs.com — Cisco Umbrella Rank: 5161	1 KB
2	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 317	2 KB
2	dotomi.com web.hb.ad.cpe.dotomi.com — Cisco Umbrella Rank: 6240	1 KB
2	minutemedia-prebid.com hb.minutemedia-prebid.com — Cisco Umbrella Rank: 5009	941 B
1	createjs.com code.createjs.com — Cisco Umbrella Rank: 2036	63 KB
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 567	267 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 430	183 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 465	239 B
1	disqus.com ssp.disqus.com — Cisco Umbrella Rank: 1474	41 B
1	lijit.com ap.lijit.com — Cisco Umbrella Rank: 844	193 B
1	windows.net prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 103698	14 KB
1	pymx5.com pymx5.com — Cisco Umbrella Rank: 101618 api.pymx5.com Failed	9 KB
1	pranmcpkx.com cdn.pranmcpkx.com — Cisco Umbrella Rank: 42858	3 KB
1	db-ip.com api-mg2.db-ip.com — Cisco Umbrella Rank: 29578	987 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 608	7 KB
1	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 17229	44 KB
1	sy57d8wi.com cdn.sy57d8wi.com — Cisco Umbrella Rank: 57608	226 KB
1	a3kvau184uea.com cdn.a3kvau184uea.com — Cisco Umbrella Rank: 59246	27 KB
1	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 3395	28 KB
1	q0losid.com cdn.q0losid.com — Cisco Umbrella Rank: 54467	1 KB
1	wgchrrammzv.com cdn.wgchrrammzv.com — Cisco Umbrella Rank: 107016	14 KB
1	google.pl www.google.pl — Cisco Umbrella Rank: 24197	408 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 535	98 B
1	flipp.com p.flipp.com — Cisco Umbrella Rank: 14635
1	mrf.io sdk.mrf.io — Cisco Umbrella Rank: 8621	48 KB
1	flippback.com cdn-gateflipp.flippback.com — Cisco Umbrella Rank: 13838	33 KB
0	aamsitecertifier.com Failed aamcftag.aamsitecertifier.com Failed
0	cloudfront.net Failed d31qbv1cthcecs.cloudfront.net Failed
0	circularhub.com Failed api.circularhub.com Failed
292	61

	Domain	Requested by
53	pagead2.googlesyndication.com	securepubads.g.doubleclick.net www.spokesman.com pagead2.googlesyndication.com az416426.vo.msecnd.net ep2.adtrafficquality.google 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
33	givebuttercdn.com	givebutter.com givebuttercdn.com
12	givebutter.com	1 redirects widgets.givebutter.com www.spokesman.com js.givebutter.com givebuttercdn.com givebutter.com static.cloudflareinsights.com
11	ka-p.fontawesome.com	kit.fontawesome.com www.spokesman.com
9	www.i.matheranalytics.com	www.spokesman.com
8	static.spokesman.com	www.spokesman.com static.spokesman.com
8	thumb.spokesman.com	www.spokesman.com
7	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.spokesman.com
6	ph.givebutter.com	givebuttercdn.com
6	events.newsroom.bi	sdk.mrf.io
6	www.googletagmanager.com	www.spokesman.com www.googletagmanager.com givebutter.com cdn.sy57d8wi.com
5	tpc.googlesyndication.com	securepubads.g.doubleclick.net 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
5	exchange.kueezrtb.com	prod.adspsp.com
5	prg.smartadserver.com	prod.adspsp.com
5	btlr.sharethrough.com	prod.adspsp.com
5	region1.analytics.google.com	www.googletagmanager.com
4	js.braintreegateway.com	givebutter.com
4	connect.facebook.net	givebutter.com connect.facebook.net www.spokesman.com
4	maps.googleapis.com	givebutter.com maps.googleapis.com
4	adspsp.com	www.spokesman.com
4	securepubads.g.doubleclick.net	www.spokesman.com securepubads.g.doubleclick.net
3	media.spokesman.com	438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com media.spokesman.com
3	www.facebook.com	connect.facebook.net
3	ep2.adtrafficquality.google	securepubads.g.doubleclick.net ep2.adtrafficquality.google
3	js.stripe.com	givebutter.com js.stripe.com
3	cdn.e3fbosf1tz3d.xyz	cdn.wgchrrammzv.com cdn.e3fbosf1tz3d.xyz
3	prebid.a-mo.net	1 redirects prod.adspsp.com
3	ads.servenobid.com	prod.adspsp.com
3	prod.adspsp.com	www.spokesman.com prod.adspsp.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	prod-spokesman-proxy-connext.azurewebsites.net	cdn.e3fbosf1tz3d.xyz
2	challenges.cloudflare.com	1 redirects givebutter.com
2	438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	hb.yellowblue.io	prod.adspsp.com
2	prebid.media.net	prod.adspsp.com
2	hb-api.omnitagjs.com	prod.adspsp.com
2	grid-bidder.criteo.com	prod.adspsp.com
2	ib.adnxs.com	prod.adspsp.com
2	web.hb.ad.cpe.dotomi.com	prod.adspsp.com
2	hb.minutemedia-prebid.com	prod.adspsp.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	js.matheranalytics.com	1 redirects www.spokesman.com
1	code.createjs.com	media.spokesman.com
1	s3.amazonaws.com	cdn.e3fbosf1tz3d.xyz
1	dis.criteo.com
1	us-u.openx.net
1	x.bidswitch.net
1	pixel.rubiconproject.com
1	ssp.disqus.com
1	ap.lijit.com
1	cs.media.net
1	prodmg2.blob.core.windows.net
1	pymx5.com	www.googletagmanager.com
1	ep1.adtrafficquality.google	az416426.vo.msecnd.net
1	paywall-ad-bucket.s3.amazonaws.com	www.spokesman.com
1	cdn.pranmcpkx.com	cdn.e3fbosf1tz3d.xyz
1	api-mg2.db-ip.com	cdn.a3kvau184uea.com
1	static.cloudflareinsights.com	givebutter.com
1	cdn.plaid.com	givebutter.com
1	js.givebutter.com	givebutter.com
1	kit.fontawesome.com	givebutter.com
1	cdn.sy57d8wi.com	cdn.wgchrrammzv.com
1	cdn.a3kvau184uea.com	cdn.wgchrrammzv.com
1	az416426.vo.msecnd.net	cdn.wgchrrammzv.com
1	cdn.q0losid.com	cdn.wgchrrammzv.com
1	cdn.wgchrrammzv.com	static.spokesman.com
1	www.google.pl	www.spokesman.com
1	idsync.rlcdn.com	www.spokesman.com
1	p.flipp.com	cdn-gateflipp.flippback.com
1	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
1	sdk.mrf.io	www.spokesman.com
1	widgets.givebutter.com	www.spokesman.com
1	cdn-gateflipp.flippback.com	www.spokesman.com
1	www.spokesman.com
0	m.stripe.com Failed	m.stripe.network
0	api.pymx5.com Failed	pymx5.com
0	aamcftag.aamsitecertifier.com Failed	www.spokesman.com
0	d31qbv1cthcecs.cloudfront.net Failed	www.spokesman.com
0	api.circularhub.com Failed	www.spokesman.com
292	80

This site contains links to these domains. Also see Links.

Domain
checkout.spokesman.com
myaccount.spokesman.com
pics.spokesman.com
www.addressspokane.com
pets.spokesman.com
twitter.com
www.reddit.com
apnews.com
www.facebook.com
www.instagram.com
www.tiktok.com
x.com
spokesmandigital.com
www.legacy.com
cowlesco.vistahrms.com
www.linkedin.com
api.whatsapp.com
pagead2.googlesyndication.com
adssettings.google.com

Subject Issuer	Validity	Valid
spokesman.com Amazon RSA 2048 M03	`2025-01-29` - `2026-02-28`	a year	crt.sh
*.google-analytics.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
flippback.com Amazon RSA 2048 M02	`2024-08-18` - `2025-09-16`	a year	crt.sh
*.g.doubleclick.net WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
prod.adspsp.com Amazon RSA 2048 M02	`2024-11-01` - `2025-12-01`	a year	crt.sh
widgets.givebutter.com WE1	`2025-04-24` - `2025-07-23`	3 months	crt.sh
sdk.mrf.io WE1	`2025-03-16` - `2025-06-14`	3 months	crt.sh
newsroom.bi WE1	`2025-05-04` - `2025-08-02`	3 months	crt.sh
*.google.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
flipp.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-28`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2025-02-06` - `2026-03-05`	a year	crt.sh
*.google.pl WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
givebutter.com WE1	`2025-03-28` - `2025-06-27`	3 months	crt.sh
cdn.wgchrrammzv.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
www.i.matheranalytics.com Amazon RSA 2048 M03	`2024-10-16` - `2025-11-15`	a year	crt.sh
*.sharethrough.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-07-15` - `2025-08-15`	a year	crt.sh
*.minutemedia-prebid.com Amazon ECDSA 256 M03	`2025-02-17` - `2026-03-19`	a year	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2024-06-17` - `2025-07-19`	a year	crt.sh
*.smartadserver.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2025-01-09` - `2026-02-09`	a year	crt.sh
*.kueezrtb.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-14`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2025-02-21` - `2026-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-18` - `2025-07-17`	3 months	crt.sh
omnitagjs.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-02` - `2025-08-01`	a year	crt.sh
ads.servenobid.com R10	`2025-02-27` - `2025-05-28`	3 months	crt.sh
prebid.media.net WR3	`2025-03-26` - `2025-06-24`	3 months	crt.sh
*.a-mo.net R10	`2025-04-30` - `2025-07-29`	3 months	crt.sh
*.yellowblue.io Amazon RSA 2048 M02	`2025-02-16` - `2026-03-17`	a year	crt.sh
cdn.q0losid.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
az416426.vo.msecnd.net GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2025-04-30` - `2025-10-30`	6 months	crt.sh
cdn.a3kvau184uea.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2025-01-07` - `2025-07-07`	6 months	crt.sh
cdn.sy57d8wi.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
cdn.e3fbosf1tz3d.xyz GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-24` - `2025-06-24`	6 months	crt.sh
adspsp.com Amazon RSA 2048 M02	`2024-11-05` - `2025-12-03`	a year	crt.sh
tpc.googlesyndication.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
givebuttercdn.com WE1	`2025-04-16` - `2025-07-15`	3 months	crt.sh
upload.video.google.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
fontawesome.com WE1	`2025-04-28` - `2025-07-27`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-02-17` - `2025-05-18`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2025-04-01` - `2025-07-10`	3 months	crt.sh
secure.plaid.com Amazon RSA 2048 M02	`2025-02-19` - `2026-03-20`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2025-01-10` - `2026-01-09`	a year	crt.sh
cloudflareinsights.com WE1	`2025-04-27` - `2025-07-26`	3 months	crt.sh
db-ip.com WE1	`2025-05-04` - `2025-08-02`	3 months	crt.sh
cdn.pranmcpkx.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
*.s3.amazonaws.com Amazon RSA 2048 M01	`2025-02-14` - `2026-02-07`	a year	crt.sh
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 03	`2025-02-01` - `2025-07-31`	6 months	crt.sh
ph.givebutter.com R10	`2025-05-10` - `2025-08-08`	3 months	crt.sh
adtrafficquality.google WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
*.pymx5.com Go Daddy Secure Certificate Authority - G2	`2024-07-13` - `2025-08-14`	a year	crt.sh
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 04	`2025-02-20` - `2025-08-19`	6 months	crt.sh
*.blob.core.windows.net Microsoft Azure RSA TLS Issuing CA 07	`2025-01-22` - `2025-07-21`	6 months	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-23` - `2025-10-22`	a year	crt.sh
*.lijit.com Amazon RSA 2048 M03	`2024-10-21` - `2025-11-20`	a year	crt.sh
ssp.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2025-03-31` - `2026-03-31`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2025-03-04` - `2026-04-03`	a year	crt.sh
*.bidswitch.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-06` - `2025-07-01`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2024-08-14` - `2025-08-18`	a year	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2025-03-20` - `2026-03-19`	a year	crt.sh
tls.adobe.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-13` - `2026-01-13`	a year	crt.sh

This page contains 13 frames:

Primary Page: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Frame ID: 978440D4F008288D875F5C535A517EE4
Requests: 155 HTTP requests in this frame

Frame: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Frame ID: 13464DD4C22DFBC8C1F6A8A7C1F0972C
Requests: 76 HTTP requests in this frame

Frame: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Frame ID: 37D267E8CB9894EA279B6A32795B6949
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvdP4AygklsQtHnq5wayRPVhp4z4qCnicRSzd_z8SeTMuOnjPWzQ5n1w3BMPc3KjN8Ibh2SRA6HBZ3__31_Hyj3pFUqy162XJEOY96ndIKMl86WSB71KAkLJTaL2ySHDQA6i8s4G8VawpmvnazQqvzcWApGi-euJfR1YHX6c9Q_Lf32odWDD8_xT_9-HKpdBuM4166TMbUwGqXhTi_uwrg8VIkGrbxJZ4tqvUIQ2gwYJUSuIntENMVVSxUNKZN0x0AwRtabJpdb7SsoMjllYdZw9bEnx4qtHHpGRIARLMdY5Urf-R1SS8hqbwNq93kns5rppbdUVTLzFijymD2Dt5IdlMyiscr33VYe7lWwDrP-e4SrRx-oZmTzkjWrcJcJQR-i2ak2D9yduhiey0va5hS4Jhco2ZiMtEZTJK2W8gii9dmgFWanGa3BjAuyb1oYajbmZz6q&sig=Cg0ArKJSzJhEP8_fAC_vEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: FFA81A60D37CA9657B3E3079A7FA07CB
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsskRyg9Yy9xPJHhlz4jX9SkANPF1cQ-vfNjeH9NBSogPQRBzF0zM2kGhD8N_S2OpczYk2iBDyQZgekhqx9x7a0o7tbFraMk1ideBnwbaGzssKwMSRVfRcKf9zG7oxaRFWKKh_1NvmU8yiXGXiKWGm7iUSpQ4DHmv9uivzvnpR-UIUB2bTgaud5yv9j81GonCh9-8kuTLmAsE1wUGulNUgvqIm9IbiXJduUVczFTyev2cjJnfU1kkXDf8ez_-2t0TtGxhwZlByUezoVpHQ3ip40V7jEXLdRZMgS-ENcJJ1gk2ri7o9UlLyZh9wwIZAHbgYfAVFOxtCVYbW_5VIBzFQW-S1kN7amp2EO4w4DD95dAejOK0a1xbANnHEwqMIErouj98DPUA88HhKWmYn7qovqugP_ZQ3DrrrwGe7kvk6Wvqv7Fgm4Qio4Gz0CEdwwpQmKVsA4KLg&sig=Cg0ArKJSzPm7YIBc01PuEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: E050FB1B3CEA28AD68CFE2D1212A51D2
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvgID_48p6lltEIdOV0l1tp3EF8C-5x3porGVgHnQzxXYMlSD63NYNqXzN9vAYKK5hxAOtFZhr5E8kanHeDr9y2SK36yGyBsyfdDgWCLzUdBulDaySN-i7Ec4QjKChLgGFsq63kxWzE3t91i70tYC-BSN0M7yB_vNvy_vJjeErZDX1R_YfwkCE9sbTvBPyUtQj1UeiNkdvb3BYpiAKnQw64IdlikXFnDl2ORwr6M-zVsgNRuYX4a8J7rDQKvdDeAkOXD26Lerf7M8juTSw3dQs-YU9pSKmoHAARqFiInTA5MywUESalHuy7H1ATQ2QfuRHDYzU6xmcuGoz6VM2mcQdXcVKB7N9Z6t7kGqReDk1O6T95Zwaeb5WOnjYsIB8MAl-c2788E5jYtiIHrF2p62LagQEo5MfH5f-nbEr6rkHw94wDUHc5sjzOD2RLmx7HKYcgMzYeXdm5nA&sig=Cg0ArKJSzM0Q8DjIKmL9EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: DA17AE7BC8DCE9F56C4F14BD1D1D8654
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsu6HExPL0pv8xvAgsnHxcmvfOK4p-X4eF9cCdeH18vdOCSWDhawI1rYkHzAf1jRTaD_JHQ_1sAHCboTi8g1g_gTj1ijMb5_dJ6e_43L1SMkGJZ9OD9WqhuezhqBUoUIqSN7mK9oq1sLbX8zLfMSi4uy3qUF2TZ5q4zes7YB61-udTuutuEnjCt6I_3s4lan-p7YxPxt_ktR9zO1eqtRfScaDV_E5wULzas2rEbM9RDX1tkw4ihMkJMup9GRQ-MBa43_8jG49UpBb1DP7oEsnHgUpuIDcssV7I7easkk6OOOTJcspWCXyr9mVh6oW0r4rM5xNyDZU6sPC57lql2YA1qcrCV-PHOPVsIhTp1F29kBmhomcgReo4mDGhItvE5QF9qPgvh4SoX-tYpAWAmdfMHQ_TVEning2hUnD4qK-bmN4uOJn_jLBuGLR5-DV_eyq2eSnnNNx8eM&sig=Cg0ArKJSzHA-lVOb3Hm9EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: CA5D14964045B9521319AB64107D652D
Requests: 10 HTTP requests in this frame

Frame: https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js
Frame ID: 47E8B15DE5258AE2E8FD56F66D890BF5
Requests: 2 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html
Frame ID: CE604D0C8A44B9E3D2835B0AD8D82838
Requests: 3 HTTP requests in this frame

Frame: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Frame ID: 4CCACBE503C6CBEC080AE95B0BEEC699
Requests: 12 HTTP requests in this frame

Frame: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.html
Frame ID: 8E61730DAEE59382132E4C86904E087F
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: B73887AC9CD14376C9A206A59545A38B
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: B58E526F4EE54B2BB5D9029987DAA682
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Panel finds 80 alleged abuse cases tied to WHO's Congo work

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Braintree (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.braintreegateway\.com

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

MailChimp (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

s3\.amazonaws\.com/downloads\.mailchimp\.com/js/mc-validate\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

292
Requests

96 %
HTTPS

0 %
IPv6

61
Domains

80
Subdomains

71
IPs

7
Countries

6512 kB
Transfer

20718 kB
Size

29
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=header
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/Home?SiteCode=SR
Title: My account

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/
Title: Log in

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=default
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://pics.spokesman.com/
Title: Buy Photo Reprints

Search URL Search Domain Scan URL

URL: https://www.addressspokane.com/
Title: Homes/Rentals

Search URL Search Domain Scan URL

URL: https://pets.spokesman.com/
Title: Pets: Jimmy's Clubhouse

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/
Title: Subscribe now

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&url=https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Title: X

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/&title=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work
Title: Reddit

Search URL Search Domain Scan URL

URL: https://apnews.com/article/united-nations-europe-ebola-virus-entertainment-coronavirus-pandemic-d14715ba3653753d7c1f122f8aea79de
Title: investigation

Search URL Search Domain Scan URL

URL: https://www.facebook.com/spokesmanreview/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/spokesmanreview/?hl=en
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@thespokesmanreview
Title: TikTok

Search URL Search Domain Scan URL

URL: https://x.com/SpokesmanReview
Title: X

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?stateInfo=&source=external
Title: Print edition home delivery

Search URL Search Domain Scan URL

URL: https://spokesmandigital.com/
Title: Spokesman Digital

Search URL Search Domain Scan URL

URL: https://www.legacy.com/obituaries/spokesman/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://cowlesco.vistahrms.com/application/login/login.aspx?ReturnUrl=%2f
Title: Cowles Company Jobs

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/Engage?ofrgp_id=735&zipcode=00000&g2i_or_o=MG2&g2i_or_p=5167&g2i_source=1stArticleBanner&g2i_medium=FTVRW&g2i_campaign=Engage&G2I_ActionId=101609&returnUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F%3FclearUserState%3Dtrue
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://givebutter.com/support-local-journalism
Title: Facebook

Search URL Search Domain Scan URL

URL: https://x.com/intent/post?url=https://givebutter.com/support-local-journalism&text=Join%20me%20in%20raising%20money%20for%20Comma!%20via%20@givebutter
Title: X

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://givebutter.com/support-local-journalism
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Join%20me%20in%20raising%20money%20for%20Comma!%20https://givebutter.com/support-local-journalism
Title: WhatsApp

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsuwr_AXp35-S3Nm-nPBblKfnmbT0UF7y5z4hC8myDtOpjpI36zzDi32Y4LtDFmhjQNZYorWK1FAPP2BscKAVORtxgpK1crcKdLJwxaXGRLn9YYI5TA6_ssU3fGHTndwzZUCcWwOF8VdheZJoUpgzZclQm0_edpdaE0L58ndE-Dfgvc39cb63QE2kMuvsgZoh9Tro8YaXkH84M0h-do9ndUQRrpE02xi9R1BVpKzGTRm7FaezqGqmCCs70w1YglLIgORcm5HVlQu2yG1SC5yPd1jVaSsw4R9v6PHA-lROBTz10ZvURMcpgUviz0PgoJsg4yeN7rFWo6IVohtD0HhwuiX-v95W_jxN2u0Ka4I08gBWeLpEDU7XogmMXOIpyFx1zaZeDHkSgOBIKKe3qQZnLZnVsIhj1hj3sjj8Cga_ieV4oh2Bmyg&sig=Cg0ArKJSzAO5GF6SFchA&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://50hourslam.com/tickets/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJESR6Y6WyfbkDUr9sUPLtL-v4-m1kI_E7Lz4BdaLB1-VfCQiOKhzm-UDnVUOKbamGPkJ_PEVxQ_pven1mffJDlV_XqONo9pSLJcu5RemGM8zEwpSnFTjejXnPN1ualBWSNr3MiJpE2xKM63D4ZYIz_HSGcSTPFW6_QTpx5LWTjjpAnFMWKGbjGe9JrL7GKg5WFi7JEUycUplNzQfpYW3gQg2nLONQwFCth9_Y5eXpHq9FzjBF9MN__Y9t_6Zb9GoA3OBlcimvK0KxmnfQrIbCXEEECWGbUfXQgv0LrLeMA9ADQh0HE0SVYd-6Ktjk_2dcer5YCis_k36pF2SVk3NRN4AGjp5oIWvHou74BnTL79CrWbCR-9v-qsNbhgIawFEkNYhXprGc7cnS0GxQhZ0G9FR7hMzUqeOhL1A9ggGqBlEXJZ91SEr-UBgHp7_l2nebq6jUtyh4PLifU0-BVZOZBEiZV5JuQcyX-3BslboSpbU5x7--DSeTft-1arOzVptRFI6NG9CONa3wk6qEOV2I583qOtIMV4hD8drfK5GBSqXYZT3KTDSNOhNcBDRA33byVdD5ILyGvrLF_k6rOEGlsd44R_6aYyngwVeFDUWcUZn2Y1XtxN7UVnYTJdxiVL2CB40BKtbUjNHnVFzIRT2r38DHf7V90iucbDPDW07Zjdp0vlxuVz0ILkEGUkJVPX8kNvB3G5_MonNd1XMJjcMM5HBV6-5VwHc1ir5t9BnF4ax3PiZeXuqSdsK8iLF2j2UNrlyHRTS76jNTM-NKpc39gXoAjQK9tWCIRR-fmwCi4kN73IDxjYC-a29gOISWyeCWboUZP7QMYdVaBRO6fW55shL57bgQknBbm4u0yukLbW8eaFpeWpNxistmUqmNh2c_S2uTN1jl0W8vXFhCRuiPo8QXQiK60oqpoOw8gD7_XNIQwLad0WfUDRGeyUN-sau-SiMch1v2jgyEMX1xhndQfTVloDVUFn5huy1iCq3l7dLRWUV940hFyQ2Uy7UoBJairCdgPYvh0fyYbblatmwKOQsVp5w2vRAHH_oRycB_4rG8-yIi5HtAKAL5H7iWE1E1zsb_DwYSvoqDNrKK57BIMvSPhFp5gI7UwYd26eOLRKdAddgyU8pBeERCGyk7AZwwfu2-vXqdJfdkk4EhT0d76TfeVvriKymsRdFZrrh4I-96oMLP9VrZ6XrpCP4_qBHfGslp9QsI3OvUHk84x6Fjp2MZoGspujKDq8tu8FU-TnefFwXNZURqfIhjeGKTnGLZJLu33wf2GI3kd-CjNJXmWyeBJR2H73Og-w_9JLrrCgf43u1RyvmKEsc23ocTzBAINYBH_JM-AHlO468tK2HnREYG49FYQ72TrdFpS0TTTaPJIczmCYqAHKmltGjaG4TYYAdlnGOkGx1-OS-Gg&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsv2nFDyXqEbrqbGln5wSALfVT_Avm1IWLrlbq4EqMZtLGNX1NjPbc_SqIp9CMSVbBWJOuYtaJXDMSdVtxgXidIkORmiIqQ__4VCGfhUaPmfoonqO63Q3XjOogs0hTJGIFMPGfLgAjGhG3oJ6x6ONCVYisSVf0jgACFgz37NzDVbb10-Qz6M7mMgs6ayz0kNtdYFL7Q2pr1vvLX4nzhZh_ANOp2Fs7_V5x2I4dwcl3-lm1IqYP7An5y9PNVknxo4R3VfouSz45N2nMqoXvkMt120Uy33J1VFhTDqDNwREBt9OnZLSi-9oGpkojgZoelzsqxEGNidUtvKHGvp2mDkmKpRM0L1HHYicKwSI07eGm3xr4i2_QV-njggh-FzIp09cRgFQeLOQlKzwnXbXcGMvLzGtat8fXdXGATQVAfI4NsZTcDt-w7dhg&sig=Cg0ArKJSzMGfnHDwGH4_&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://spokanelilacfestival.org/festivalweek/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQz4b7YW51xlmBqWndb4fY0l1The04yQcIM9qBr8pr9KXKFjsKf_B8s5xPflz48OagXhfEkhSq8S5U9oxLi8_mRK7FD3yka7ooY7IPaKFp0XBbr-AvoR4M3PDJvyaCu8QWVnY9eDG_Yv5uYmUpBVTphAVodsej_Nqe4oH7_9g6e6ZthAdnMbRUNehjTLKI1Srp6WdooEJYFwz98Ep6FRz3jHtVSJRu6JGznNBar_ukmhV7NpwlL7Ku_Nf_ubTVVznKpiad_VOKhXmmr0gaEENg9a4d432sClPxnH0kDQ3_2QKjsweLOcSbUfa5fltauwqOAQ02SERwOucuurYZTGG57dHM__wtgrYpOA1CMuoTxX_Q1jf2QV7Aa_rAUWCibYRMMehyMbosB5Wc0G5Uo_HCaxlL-nbq-yWKr8l7h3F-E5mWYFMZw3Cqu5RecuiPpwqAmO14Piv-6wQ85ijuOT6iu9Xj66HHASQE5yCWTuo-OhxEthF7bQ0WaHRl0GpR57jEIf6B7xB4GoBoaU864IiCU8vx5rg-2XSfdKaO9tUPtDLA8bRAetJ-Ia9rMwp2adT14-PSiMuJ1eZ_KNRQXPuS3sFe7Z5qlC31KVtG2SoaTpxVjRnHo_ZOaNyvXCX1Ke-THmMBU53pXZ_YJg3a5o6zSgacFPF3BKXadfDzOxIOe8j3iVGoDtkRhmmUdb7gKi8X-5dcauNkgzrR2E5sPFD2RWyKK6s7tV1te7_tWYcsTgjiq2sScT5XtyednaJ_SbkGDT8gM9NI5ZTc3K58H02ETqohgpbUe2dC_ri_kplce9go-U5es9o5ELCXz85DXVCqJQYL3vJdaAHiw4oJF_7JIaJEyzaV9oDmF-3HDfe1mvGjXd9obf3BBmj-O4kTypnLnWLvsSUzWMGbiUCYWkLIXOujhbk9baohgAi7nlE34tQwTG7ExzZqHNVxoz7xDZCy6axz3mEU5W5ZcoW7LJBzvMMwGecjFRxfC_m4xKhVznUUmyBeNhMg5UQkbF1gZadnCPIxk8mRump_fRFD5yQXiREPE7ngPkPWq2AL_doPgVFZ_FyNngfdLtb2OacNQpjBbT56QBuhFcrNCDGd7fABuj1ahOOxAx5s02-60a_t9x4JNsgJwMLMMcV1QahBF6w2REuODKPEUruVWfjvhR1qTC_Pud_P4GfAukpXwOhpABsunEXct0xGCXv2Wnrp6ymfxL_jm3YcW1rj-sIZuvLjbm78hy6zSPA94PNJpDnD84pl_fIprIm9G8nlMAQZxycB0iEK87pMf5UD_aOxIG8_WoKD7Da4lRE8or0PD2yTgZ9SF5qYPmGWO_MPosmyxE6vgsyEH08Z-t1vQkv5ljPoQ1sUqaSUWFqXRyTZm_U2jYeRrUgDyBNXDCW4lpXF9a_qgCK1QrkDmnHzFTck&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsvsMrzOcdCHKEKd96RtH6r1b3HGCYuD7Zpk4ApqYeVZKKbrUaEjAmB5lsIvLF5xIJZwLeSrRI1IoerKYR7aQEChk0PcNHDzgg4ixCZnzHiYT-VogsnEVd_QP0tbyyHacGeq4qKWch4KpGQwDDA7fkJKEE12Oa3BzKo8Xt7OrMSFlJ18YhMU35U_iOU6CesSjzl5v1c-BUhVFE86H-x1nAHPFWHjeP1CS5dagSaZtRiHXNDJqluTS9NSV0jGYLWBrKZs1bmGtrlPq_q24lokgeVGk1rUbrHT0Ci666ObZhAJsKNg9TCKMlMifKEO8sYQAvpUpWUaUh31b04Wc7EiQuYeP4I-V-AWf2FoD1oz5yh2Vus1Pb0BXSN31jQc7sAsGRhr5q_nws6HmNVuf7eTpfyBy3ofJJIiz_1oUjkNxU91xwf02_V7ZcsD_g&sig=Cg0ArKJSzBR5j8lXar5e&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://50hourslam.com/tickets/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQpT9zNDujTYXco9MH31tzZ7397Xjw5YO0P_d7V3GV4MXHb92NUcRo_PElOPl_SEgpOJaJmjrgoVzo3QjbtMJjilRAHBJiIHf5ash3YoCEvQF5h_5YjwLSjQ6yDCDIQKIvx3xoFAoSE7z4nWWdUUsY_3yuIJf_3BgmKR0sMs-iH6PeKnB9DcXbTMAH3j6JNw48aB-UkRCoeRFHAKsZedWEZpVd7ObUSOsqeshq6g2dTT6cuqtWGKJ30k5eYF8QftMO3iZakTMpEDpWglfm0fXkIcRRDxj-ATQ-UrS1d6x7b7WZbrsO9IwRxpuK78yv5HzWqnP-4S0GUUs6SHsU1BPJJ4VzhuAWGuRcLokt8w_ydt_h1_hd_Mmh5Lca7jk6Eo293fPcU1oLzlScKBUvVTUzsuaDzJNC6ZPaTHuIfXHilLN49tUy5wXmL72xEPF_aR3lPnY0K-pwy3fePpTxN46_nnqCQdFmorhl6bxeXIJTc00K-9aI7wkpOtV_k6wTrGiScKAmRc865jnf21o-8pnmpRVkjB202OO0LRPziisbHWagZRdSoyGDI6uBjKcqGjE2fnYdR_069whJ1s--jOJ1SXXsqIi7cfhd81NEOamIFdYBZqKYNLNGXcVLeS1oJpuyc7w76LO3UWwe-bo8C5i0fShj5e8GfdCX1t42wonlbxzJjCfRYs-Ru7cAA4m9bFiN_Gse73SAx7T9G8zQ8ZrRoyazhpNdAQtyQxHLajSlOQPgdsJVKDRuZvV8-2FN64iDmChrp-y879MItUfKJ4JfpoNgezaWMM92rfXpp8EpP_CdlZ64RB63usCbUaq9whORztUBRne60wmS9Uu2IuxZsN-OMfCftX_x3Nq1MqIsCDMRRrsZzv0Bv4LitDR4X7yqm5SuPKcj9YfLhNiUpsFFWtRwv4ShoCItJovIhSD4hhJjPWfEkvnGMOpur001rF5D8OaUVowQxNe7w0iL5KwEU03qRNExo7ni1jGqJJlZOh_5C5bfCROrbqsOv2R9Wve-lOIEKaZ624ZBxUgqQMuMwDOgJ5bGmPesf_drg7HD0ZTbZXPjQW0RBUlAxyV-JyTA-mJNJhKYN0HnxLmYWqIyfzqeUEa1cvKBvF9xDVIc8SrGIQgJrbMyyriXjl9mMqzEfReQCrwzsOeYXeIsvjYNvACE2s_qJV38vZRcANMEFwhPwjZpsMUz8ICbSjbnGQ8XRy98mpMrCa7AgC3wIXem-PNhmRj-9cIHIMXdff9zq6IXVab4rGktev9bVNQGlTT2jXEuQUVEeq03OV__0kkmkXXOO10zS-Ab1W6yPODxj2vslLZTFiy-b6VojeKJ9Q230cTmu5qewPAR4mEgYQKfXuOh30yA9JRuL3m5sD50GA2Nwtmi3eOyL7kxLDcP3iluSutZr_Dz7aqr-PduR5D02&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjssdryHMh5ypO7_oiIu5g1owTg3Itekc3Hn3WzCHbuiq5ZSXu-icj8BB3XfdvVaG_OhhAHbDhyDf9uDpZ-ycyZ7aRbGxMD8jrCq2R56GRl5hA9msQHbEz2AcjUo_aXWII7mYiDOpJiuxIiyJjVke5Ccct-fvxb4ZV3vXKzJaJhWxN3UsGCbr6gMZBWekVxA7MdoWVLyJnhdWHLyAotg59bvOJlGIdvXBUMNjz18e_X7fod9-fdj4yyzukcjXXh3K4Ppu7Q57pb6k8-MsTq_kVBUvMXKYgIs705GEklTfqFMLmXuuaVzMuUvmWb-1qe6qW5SgkdhDik8wdlzXjTyIwSvTeBElmnjjOed1rcMlt3bN6Fv542bIMdHpAou-LBlEDtl5vEYGVF8vYcO-UnDzWvX49EJKGvJhxSIUKU8d8een2MfuO30W1R9G&sig=Cg0ArKJSzInRq69LJg8-&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://spokesmandigital.com/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJERM1BQdro5PTLNNaWB9E0O0_s1VpmaAhoKd9TdOaGl5jh_7HoBMUJUTV6HvG06yLnqpfoYQQikYbZtEfT3gKbqYzPNVHbP8khTzpTnuG9IKEex8RXKdwANWSAmaEBEPIWKzXu1TUIJywmpnp9dZCouG8CyabzzQDlMHbBNQXeclnsD_x08QesiA7HCOh2BovVZjYqIhxsCFNe5KhPNX-gPpoxGx34CKoq8j75CNDpAv7QZVfBSwj4mdnDf9DeKD5p67JasvPGlz_eSJ9kctzZ1NFrwUC34dZYDWFMVde9ZsliSmPStg4XlUnfzV21xzQ2W9I5KQQ9Tu-iWu-95lWY2eFC1s0KksOqkwPeEBLIwrQxWVysisakzLxrHw4CvwNZGhEWNAuOrqIZqVErADqYl633Pt8mY-WQCF_bzuhe2mvOT89YvjQ8O5UMk5ALk2gUgG2rj_EW1tytcfbrMg75IKZSmTD0T1aaI4XgtbxNsu3l3VLuo4tmVaZS0q6jA1za4LYVbjDUafY1NZ_ab5F-e5X9HIsI_FG7YFuQtWkVC7EaFk2i3USzWzodNbvdqqUQkPkH9nJ5jFFQ4O6fJMpb7UX8RNRtSd8i2VP9oklGPFXkqVcrPvc-66vsGvgr1k6gJSiHqeV3Camn-7itftq0kGuFx8A52Xf5ttqhKlDhWqgCF9IVKg7rEZ1BRj0eJBiIcRSyrslMMfesqTfFs7LREQBaRwWUV70yFrqGTS583i9UXViKKBxtuwUGqabY1FTloHELAMLi1_U-LP-p_IFSZKgkA-AODLhxpsaDjG5iw_oV5pRGlKNfn7bhQnvCDvkiaDzOPJA-C11D1gKJk2d56U5U2PpKtxxm4x03gJ43fF2v_1XUS8Lucy661Z176mTzx137u25vZWqUoBir-xRVHTFnw7MFmvwRmx0-xHn4zB7FjaEwDsIEGYYJURC_OE-qFxCe73emqumZVFgigbM7lbyaCDUL9SC9p4wwn3itBeSXIUI4MUFtCUkn_3qgLCvGoSu-dYAGLHRUpYh_vd6m7jBwOwagwFuNRxb5vAV0b_13ymFpmEBnMnIXxPtG4oVR36MyZ26S6mwNUsY4JKHkvUCg5L2K1ci0PU0XKOev07dTldsHLKO_lmkoaR068HbOdnZVAFOniKQn8wKmInBQqgHM8F_a89-ALhWBpoh1tzMdtOfe_aQsGXHsZQefd3RLtmzejWG0TYc9Fp9ThjPu-LgZHMUo7IE83UvZC0Gk-uhZ9JUXi1HTFU5jfXZgyCx440AAIi6JqOtWHi5Y46OiQOX7zluq-4xL13UtsG5ExkR3gZcWxatqIiUERw2G9EHQiUserR_4vMcdBnhgqK00gUDEp60f1lrmc5ccqE-5GPqGb3pZQhfXZ03okPK2LDUCDTipGk3ZBizHP3km6PRWs&opi=122715837

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQx2W0TQqta6EAeZnZ4nHVnh-H-BC57mV2OVrnHGQXnG_ShrkXKrTJeTFXL_-5H7O6G_Hy41CKnbti1dMk89451YEuW8lKkUswRerJhNvwzdWvmx5PYPAJihoFGFDJs2wjltXnGjOYIiuUSanf0-Ar-37C1gubytXMzKSPJmupqkfZ6dfsWd41bJbvtZA7V21SUAqYKHn6r3EbdjhD6Kj2QQvXBNWSrvllb7G9CZJ_YsIViw4-9uVmf2tK4vgB6lW7AJcBpPX44o-FW4flFfS-67w3NjZiymMFYqCo5zUaLDiJNAFyUc1sg_UivfpSwOraAFOzAXESsMfQx7j8VgWFl8G6sUICV3c_TxKr9KfNCtFiywOCSpEgFvo5xXnkYBvdauRm_QAafGtgCt_1HuzDNex7Ad6fhWiPARizcDfg4v909YT740XwTPsid1b1Fzoi3h85Fyw5L0cczge19SGQ3oQys-MvK_Urw-E1g0O0CGTm-Zq2ctN4eSVzOZSd99Yd3YqCecECGz6KeojAJ7rdmZpmC0OXflj9UD6-G5p-16O_B_TI2s0_UNLI2ApEqvzurwZ-nrJYJFZouh6ASDPkmMnU_KzghH3NsGEZw-paRvaBxlPiAIy7gOclCbonHpAKsueaudUvnb9dCH3l14K3pb2fHAjHLskYz8XQZbpAfujIoGVtQGVl9AZOJ7ClnWL1B_JTKuX3Yio_erOaW4IcJNjwIhOf8R4tJct3ZI2oJW_4t_A-zbOx3Mpsuhyr3ZSjM48xcKfIz3c8-ysOibAqA4L1DAsdql-Tr5mXdcxfyxHZ4eg86YpzDhmqMZXtoMsRSLNETSjxbaZDM6pNhqW9bh060QYngw1zlkSbSh-HWYjK2GZjiNHdQMQn7vF2Emm-sKPVc6vQ3f5lYjjDd7QGq_nCjpvL8oZFeYy5Kvyrf-JmDr1EC-DXUSMLM1nYkocKqdV5TIlErTVfCF187XJPTv71qSwVz4TA7TReYoWpzEvKw7SIJV5zhbRxL0dw4JrREb4W1qh6x2CWJynoMs3EdegzsKusRIPtJYfWgCVZqOPVMXkrN0MQk2k0ITYEDEeGMS3F2MCCWAmwfFVAW-tmOwr-8ifXYBNpQbC7b3ZEqDs2bMlpj7yJl&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click%253Fxai%253DAKAOjsuX98kSz7wrE3NIZb9YcAGCGZyC-M_zyWr92bQVziUwPIVwd-C21DTTDo1Ir6JNefQVh_Yd6RjYwNNh-0UadV6dPZ_Gd5hq2XITz1gNU_JquwLi4SMlAaojHv_ymulFEAb9g2IwCzrvClThNjmVojvMT47iQfveCz1DbqbrbSXLPxwEMEc32z9AXnhTSXZ7V1oTD3UKD5coZ-jFDhLm10yCJgH_rfgBwuEIKEL_OrIRRtD42y12U9kwHjiRg2YFsGpZcqAWNNCq3g7SEnIBouW3ed5Uk9VdWsgOjW_L8aSaBDMHOFjzoQi-9vLXRVfysA0iYHTuNijwIOF0B388AtJUSmtwSyrY3oaF4JHz8LaU45DhP0VJ_AyvHD8Pkd0bLIjJNNHUJG9GZQifvKsAQmopFPO0_Kd03MyA5dFC4B1hStOUGldUgOdQ%2526sig%253DCg0ArKJSzEFJgT-JSfEUEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253Dhttps://spokesmandigital.com/home/largest-audience/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1685 HTTP 301
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

Request Chain 111

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback&render=explicit HTTP 302
https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js

Request Chain 209

https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js

Request Chain 238

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
https://ads.servenobid.com/sync?pid=327&uid=&gdpr=0

Request Chain 240

https://ads.servenobid.com/getsync?redirect=chrome%3A%2F%2Fversion%2F HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%25253A%25252F%25252Fversion%25252F

292 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/ 145 KB
40 KB 850ms
713ms Document
text/html 18.245.86.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-10.fra60.r.cloudfront.net

Software

nginx/1.28.0 /

Resource Hash

920d6ad6f88618b9536120a740d74c1523313fee1717ef5a75385da286808e8d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: max-age=18144000
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 05:19:18 GMT
referrer-policy: same-origin
server: nginx/1.28.0
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,Cookie
via: 1.1 bc3ecf5f025b0be9b8c39c5dd2dace2e.cloudfront.net (CloudFront)
x-amz-cf-id: CehIGkjlGyGU4yDzqlbH7XPOkyz2gv2MTdvNwM42Kxsq-4Ugj6BIiA==
x-amz-cf-pop: FRA60-P6
x-amzn-trace-id: Root=1-68203355-0565eed33e5877ab56165780
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noarchive

GET
H2 200 sr-loader.png
thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/ 11 KB
12 KB 204ms
72ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/sr-loader.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "7b6592542ec6d8d4377eb143251c2f5b7d76aad9"
age: 18601099
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Thu, 02 Oct 2025 22:20:59 GMT
x-cache: Hit from cloudfront
content-length: 11662
x-amz-cf-id: be1_pDr34Jgimy3RPa2zgjUAeEkDC4BvH1YTyMcicmN9ykGnkEgJEw==
date: Mon, 07 Oct 2024 22:20:59 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 style.min.52136563b229.css
static.spokesman.com/sites/spokesman/css/ 748 KB
178 KB 190ms
63ms Stylesheet
text/css 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/css/style.min.52136563b229.css
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f58921ec9151a34826886c1f0cc2c18e289c5a77bae74084ca05084f298db597

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: accept-encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"52136563b2291e5e6b2b8b9cea4adbca"
age: 3475559
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: FlmiOWXVCnlvhfUMi2l1shlKyl8IxcpueJtdeFfurh8bX9fzW6lS2A==
date: Mon, 31 Mar 2025 23:53:19 GMT
content-type: text/css
last-modified: Mon, 31 Mar 2025 23:52:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 jquery.min.12b69d0ae6c6.js Show response
static.spokesman.com/sites/spokesman/jquery/ 87 KB
31 KB 41ms
41ms Script
application/javascript 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/jquery/jquery.min.12b69d0ae6c6.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"12b69d0ae6c6f0c42942ae6da2896e84"
age: 18074154
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 0Qp7JXF01JcxUuCjLm56nbhDnp1hMW_Dij8ck2Q73sQ8E9EQRzh_xw==
date: Mon, 14 Oct 2024 00:43:25 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 00:13:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 critical.min.01e92d87dfe7.js Show response
static.spokesman.com/sites/spokesman/js/ 22 KB
7 KB 48ms
46ms Script
application/javascript 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/js/critical.min.01e92d87dfe7.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9ef22c9cf20460bbc639afd09b42f03a4e91db23bf8d774280653a7845b157de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"01e92d87dfe75f665e5b3bc2ea97feae"
age: 20337047
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Jov7lDs3H4JebgAjSyh3IbHCyaxKKgp4AwPSRhBpEcwjOQw2VRdI8A==
date: Tue, 17 Sep 2024 20:08:32 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 17:27:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 435 KB
143 KB 207ms
88ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

259f0c66228bbf666be1d43e7ba2df1cdbe4c5d5ec11f92b7c7309492e897e98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 05:19:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 145603
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 flipptag.js Show response
cdn-gateflipp.flippback.com/tag/js/ 93 KB
33 KB 285ms
166ms Script
application/javascript 13.35.58.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-95.fra60.r.cloudfront.net
Software: envoy /
Resource Hash: 93bd03433acb8dab6ec72e7b9bc48b4997b673b2a3db67af26df2c2d49615262

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store
content-encoding: gzip
x-envoy-upstream-service-time: 8
via: 1.1 f741e5a55bc5bd136ac1f5406bb11d88.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: s3zkoL7wjMtG9AhRIsmASFNtulJ-KIEY1ERDPbXGlcYQ6nQVEqzz2Q==
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/javascript
vary: Origin,Origin, Accept-Encoding
server: envoy
x-amz-cf-pop: FRA60-P10

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
33 KB 123ms
56ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

b0c94997af47d3645d2b36185b6b5aeb6bded75a3f966c5c903bd0461880c793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 271 / 20219 / m202505060101 / config-hash: 4568831147539001230
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 11 May 2025 05:19:18 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33548
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK adb.4364783.min.js Show response
prod.adspsp.com/ 2 KB
2 KB 218ms
83ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.min.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8282af7cb6a3d9dacc0d3fa3d57e958b0fcc210d3acd82b2591ea7198421124

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"040b0a820fd0d7e3780d2dbe79fc8fa1"
Age: 111
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 1eYpe2iLEKiII1OQTJ3ALOBWDqCR0K-orNJdFFrS0Ib0K4rOEotmmA==
Date: Sun, 11 May 2025 05:19:18 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:01:54 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=1800
Connection: keep-alive
Via: 1.1 503c2bd0b7e26f747c58a5188346ef54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 base_ads.3d7203f56dfe.js Show response
static.spokesman.com/sites/spokesman/marketing/ads/data/ 4 KB
2 KB 46ms
45ms Script
application/javascript 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/base_ads.3d7203f56dfe.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a120a51667f8a7d4c6202c1ca0df9a2a458633a96f2c1c57116434887a5d3565

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"3d7203f56dfed810ab1f436853ddd579"
age: 21186120
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: GEAOm_kHCXe6DQ66BUxCaNu5GgM5YXsGn1haesAXypW42jjOzxkaNw==
date: Sun, 08 Sep 2024 00:17:19 GMT
content-type: application/javascript
last-modified: Fri, 06 Sep 2024 20:43:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 day-partly-cloudy.png
static.spokesman.com/sites/spokesman/img/weather/header-icons/new/ 12 KB
12 KB 49ms
48ms Image
image/png 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.spokesman.com/sites/spokesman/img/weather/header-icons/new/day-partly-cloudy.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 103336c754fde9c2c7fc565bc5385b94409c0d5480cd8564c25f18f6cced5a85

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31536000,public
etag: "3148ca6be1dd30f49fe8c5a64b9f5781"
age: 20238135
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 12254
x-amz-cf-id: 3rCIt4VZ5K0z_JDJrRktAakSjablUq3pdRFwyxm3gcFCMZB96VyudA==
date: Wed, 18 Sep 2024 23:37:03 GMT
content-type: image/png
last-modified: Tue, 17 Sep 2024 17:27:22 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 615357f72bff3.hires.jpg
thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 165 KB
166 KB 458ms
341ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357f72bff3.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: 02a30ea6b407de1b91903c7b846cd49cf8bd7fde84369dac046578a845b2481a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "f8ad905a26a2164c578c1054bb358a45d75b8dde"
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:18 GMT
x-cache: Miss from cloudfront
content-length: 169392
x-amz-cf-id: p0NiHjJEpu112wgy0PFqaQDYJVzLMZ-f0w7O0QbTtq3xWqex_B-1gg==
date: Sun, 11 May 2025 05:19:18 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 latest.umd.cjs Show response
widgets.givebutter.com/ 464 KB
465 KB 252ms
193ms Script
text/plain 104.20.36.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.36.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3aa2c059437af622be6abf87d58e045c85321f5fa7a89d1a3e4c033aa4b5515

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: DYNAMIC
etag: "00bb578424f1bc3ca62fb11de89f3806"
cf-ray: 93df387defcac048-WAW
accept-ranges: bytes
content-length: 475334
date: Sun, 11 May 2025 05:19:18 GMT
last-modified: Thu, 08 May 2025 17:53:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 300 KB
102 KB 233ms
116ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d87c999923b7320b6ddf3919e0d76f409d36048f087311a6ceaab267d182ed73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Sun, 11 May 2025 05:19:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 103905
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 marfeel-sdk.js Show response
sdk.mrf.io/statics/ 175 KB
48 KB 113ms
53ms Script
application/javascript 104.19.220.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.220.32 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1768c23832bcb03d3fcdd3f6edf07a71f0c5c7b6323e50a4fa2e9276cd30800e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-response-time: 206ms
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 11 May 2025 05:17:27 GMT
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=1800
x-envoy-upstream-service-time: 219
cf-ray: 93df387debafeece-WAW
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48688
server: cloudflare

GET
H2 200 sr-loader.png
thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/ 11 KB
0 0ms
0ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/sr-loader.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "7b6592542ec6d8d4377eb143251c2f5b7d76aad9"
age: 18601099
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Thu, 02 Oct 2025 22:20:59 GMT
x-cache: Hit from cloudfront
content-length: 11662
x-amz-cf-id: be1_pDr34Jgimy3RPa2zgjUAeEkDC4BvH1YTyMcicmN9ykGnkEgJEw==
date: Mon, 07 Oct 2024 22:20:59 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 681fe3c06c09e.hires.jpg
thumb.spokesman.com/aaWKEji5bAFr5bWmZmw2sk2LWf4=/300x169/smart/media.spokesman.com/photos/2025/05/10/ 7 KB
7 KB 53ms
53ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/aaWKEji5bAFr5bWmZmw2sk2LWf4=/300x169/smart/media.spokesman.com/photos/2025/05/10/681fe3c06c09e.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: dbc4c944a2abdd71f26c31458b90ae46a60fcb5f7673cf86e155755015282c03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "efb674052f070571a33cd1186008da965dd970dc"
age: 18786
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 00:06:12 GMT
x-cache: Hit from cloudfront
content-length: 7034
x-amz-cf-id: IByzr5NkJB_dZvQ6o9vlt6o9ONoCzdoX3cNPSatSyNBwG4gKRElg4g==
date: Sun, 11 May 2025 00:06:12 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 20BPL-201208-KP-51-3076.jpg
thumb.spokesman.com/HwfGOiEoud1-ndvvfOa2SwaVyGM=/300x169/smart/media.spokesman.com/photos/2023/10/20/ 12 KB
12 KB 62ms
62ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/HwfGOiEoud1-ndvvfOa2SwaVyGM=/300x169/smart/media.spokesman.com/photos/2023/10/20/20BPL-201208-KP-51-3076.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: adaf07c7701d826d9875cbb76bcb113ee13a1058ae744e4d18a10f2e4fed258c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "c53f4d961cd73db5fb6df2b819df2fc1566f1110"
age: 2641893
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Sun, 05 Apr 2026 15:27:45 GMT
x-cache: Hit from cloudfront
content-length: 12092
x-amz-cf-id: 5BinHTYE59dwkzYNn3ypHcSGAN-0krdhkRCWWrygDSoM-TQ0cB2KUQ==
date: Thu, 10 Apr 2025 15:27:45 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/ 532 KB
167 KB 38ms
38ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

1dfae417465bc4ba3e518e6adee43d27c0aeee39eaf536d68ca301b0cafb1145

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16206274684016054142
age: 73933
x-content-type-options: nosniff
expires: Sun, 10 May 2026 08:47:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 10 May 2025 08:47:05 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 171178
x-xss-protection: 0
server: cafe

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 292 B
158 B 66ms
66ms Fetch
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

d6babd302465c4da1ecb58819a7ac7eeccac8c5673d87f733a3d676258cec6d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 133
date: Sun, 11 May 2025 05:19:18 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 165 B
785 B 184ms
104ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 459ad44dd647d3544551e4ab7848cbfdd29799adac87a8a7e9767acb66e8fa79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
content-encoding: gzip
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df387f3c6d2a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 120
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/json
vary: accept-encoding
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505080101/ 64 KB
23 KB 42ms
42ms Other
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505080101/gpt

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

2f4e461046f3bb7885829e48f8dab784f2b1e65c8a115742488762af28829d41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5808547447683133843
age: 32196
x-content-type-options: nosniff
expires: Sat, 17 May 2025 20:22:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 10 May 2025 20:22:42 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23401
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505080101"

GET
H2 200 noncritical.min.e3d124e9151c.js Show response
static.spokesman.com/sites/spokesman/js/ 2 MB
564 KB 42ms
41ms Script
application/javascript 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/js/noncritical.min.e3d124e9151c.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d9f8cd6984fed9b5196dc9b4d2da9ac37226be6c94a39ee2f56073f73e22093

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: accept-encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"e3d124e9151cbb7ae0023cc6af872bb7"
age: 10140681
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Qq52hLfIypTV8rxQ6GkkZxsB1QddRfigFCmQgjeW68xE4cRalqPL-w==
date: Mon, 13 Jan 2025 20:27:58 GMT
content-type: application/javascript
last-modified: Mon, 13 Jan 2025 20:24:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK adb.4364783.cr.js Show response
prod.adspsp.com/ 161 KB
58 KB 49ms
48ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.cr.js?c=Cx33bcf6f:mafk1c8u:16
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a818e9f64e6062493c2f08078990ef5529ae59638c8202c690520ae905b35f0b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"c9b555fa7ca4c1be0f50f931d22a2df6"
Age: 220508
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: pkuVNJTplL4tD3cbbHbRnflvXRkTgVRXDkXYQhGJNkjhprQAJPwgbg==
Date: Thu, 08 May 2025 16:04:10 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:01:57 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Connection: keep-alive
Via: 1.1 503c2bd0b7e26f747c58a5188346ef54.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK adb.4364783.pb.js Show response
prod.adspsp.com/ 261 KB
91 KB 154ms
78ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0cb1bf32539483f685b02b014d2a44009828e0345cfad31af0f082df7bac97a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"9fe74500637ac1d70005f5356e05feb1"
Age: 220508
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: ruuLB0Tpi2WlkF4nUc6Dc6DCptnZrw1oTAu0o7gMDoI7UOSLxmRJMA==
Date: Thu, 08 May 2025 16:04:11 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:02:06 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Connection: keep-alive
Via: 1.1 ab85f05f60638addab7913cfb252c99a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 1009641 Show response
fundingchoicesmessages.google.com/i/ 22 KB
10 KB 193ms
73ms Script
application/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/1009641?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f14.1e100.net

Software

ESF /

Resource Hash

864b19efbddca842373a716d23fafeb056990174c8560865bf026dd1bc1201bf

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CsW3Dc5hPQxQlRPoZJtubA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDu3XuT9caRm6y7Nt5iPQzETdq3WbuAWIib4_qzhoNsAit-_zFS0kjKL4xPzs8rKcpMKi3JL0pLTkstTi0qSy2KNzIwMjUwNbDQMzCILzAAAFZvRS8"
content-security-policy: script-src 'report-sample' 'nonce-CsW3Dc5hPQxQlRPoZJtubA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 432 KB
141 KB 74ms
73ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&cx=c&gtm=45He5571h1v71896582za200&tag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

00acb35a95afb24dd8bf9fd2dd8109bc2de409077a77846386391c4c2d0d1f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 05:19:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 144551
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 177ms
59ms Script
text/javascript 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 1780
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 06:49:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 04:49:39 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma20153/575681700/20/
Redirect Chain

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1685
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

148 KB
43 KB

65ms
64ms

Script
application/x-javascript

107.178.250.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public,max-age=3600
content-encoding: br
etag: "0033e6720ea8d009cad21d1cffea7a41"
age: 77743
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache: HIT Sun, 18 Dec 2022 07:13:38 GMT
content-length: 43903
date: Sat, 10 May 2025 07:43:36 GMT
last-modified: Fri, 05 Aug 2022 08:39:28 GMT
content-type: application/x-javascript
server: nginx
vary: Accept-Encoding

Redirect headers

cache-control: public, max-age=269200
location: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 05:19:19 GMT
x-served-by: 1-gc-euwest1-xgfw1036
server: nginx
vary: Accept-Encoding

POST
H2 204 beacons
p.flipp.com/ 0
0 517ms
232ms Fetch 34.198.218.70
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://p.flipp.com/beacons
Requested by: Host: cdn-gateflipp.flippback.com
URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.218.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-218-70.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer

Response headers

access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:19 GMT
x-envoy-upstream-service-time: 4
vary: Origin
server: istio-envoy
access-control-allow-credentials: true

GET
H2 451 712559.gif
idsync.rlcdn.com/ 0
98 B 223ms
122ms Image
text/plain 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/712559.gif?partner_uid=16113c39-2548-4532-a67e-3a9e5b95a653
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 05:19:19 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
88 KB 70ms
69ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-230256-14&cx=c&gtm=45je5571v869949972za200zb71896582&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

3ce60d9d35f57c9a4f26168b12a9322caa9d9cd834473abd20454b39802bc421

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 05:19:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 90403
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 146ms
57ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746940758631&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&cid=1273096636.1746940759&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1746940759&sct=1&seg=0&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1520
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
550 B 259ms
136ms Ping
text/plain 108.177.15.155
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-G3BY0LGVDL&cid=1273096636.1746940759&gtm=45je5571v869949972za200zb71896582&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.177.15.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wr-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.pl/ads/ 42 B
408 B 177ms
81ms Image
image/gif 142.250.186.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.pl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-G3BY0LGVDL&cid=1273096636.1746940759&gtm=45je5571v869949972za200zb71896582&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&z=976242626

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 11 May 2025 05:19:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 rfv.php Show response
events.newsroom.bi/data/ 27 B
128 B 56ms
55ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/data/rfv.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79df73fd1377483384f7b7565e98c4a430889f0388db05634271f9f302faeac7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
content-encoding: gzip
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df387ffe0f2a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 42
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
vary: accept-encoding
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H2 200 recirculation.php Show response
events.newsroom.bi/recirculation/ 12 B
284 B 118ms
116ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/recirculation/recirculation.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df387ffe132a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 12
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 204 ping
givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/ 0
0 542ms
463ms Fetch 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/ping

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 05:19:19 GMT
vary: Origin, Accept-Encoding
x-server: prod-app-i-0f0aea55263d14c0d
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=67240, must-revalidate, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93df3880b8260273-WAW
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
access-control-allow-origin: https://www.spokesman.com
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H2 200 p57vbL Show response
givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/elements/ 228 B
592 B 686ms
611ms Fetch
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/elements/p57vbL

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff29561d28196b2e6106ed73de445b309a6b3d29c61b275ac06bea071b2d9095

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: EXPIRED
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 05:19:19 GMT
vary: Accept-Encoding, Origin
x-server: prod-app-i-089ad00bb53634080
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=60, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93df3880b82b0273-WAW
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
access-control-allow-origin: https://www.spokesman.com
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H2 200 news.e45f173b1c36.json Show response
static.spokesman.com/sites/spokesman/marketing/ads/data/ 3 KB
849 B 198ms
101ms XHR
application/json 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/news.e45f173b1c36.json
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/base_ads.3d7203f56dfe.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 23dd2a9d31ac5ee27bc8d601812cb813b3f986f704c73cd74242691221021ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"e45f173b1c36bf035e1b1c757e4b268a"
age: 20152879
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: h7_e-OrTHjG4jfIhE6LAqnczKqP0pkJMFZVJIXBrlJAyefpGjf4yHg==
date: Thu, 19 Sep 2024 23:18:01 GMT
content-type: application/json
vary: Accept-Encoding,Origin
last-modified: Tue, 17 Sep 2024 17:27:28 GMT
cache-control: max-age=31536000,public
access-control-allow-credentials: true
via: 1.1 54458302557dcee9766f255184a02288.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-amz-cf-pop: FRA56-P10
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 75ms
75ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972z871896582za200zb71896582&_p=1746940758631&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&cid=1273096636.1746940759&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAACAAQ&_s=2&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746940759&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&en=page_view&ep.author=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&ep.primary_category=nation-world&ep.publish_datetime=2021-09-28&epn.object_id=979335&ep.content_type=story&_et=2&tfd=1614
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 615357f72bff3.hires.jpg
thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 165 KB
0 0ms
0ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357f72bff3.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: 02a30ea6b407de1b91903c7b846cd49cf8bd7fde84369dac046578a845b2481a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "f8ad905a26a2164c578c1054bb358a45d75b8dde"
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:18 GMT
x-cache: Miss from cloudfront
content-length: 169392
x-amz-cf-id: p0NiHjJEpu112wgy0PFqaQDYJVzLMZ-f0w7O0QbTtq3xWqex_B-1gg==
date: Sun, 11 May 2025 05:19:18 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 615357f90db28.hires.jpg
thumb.spokesman.com/tkpMXt58RPPtXb06qhV9GQYtTuA=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 137 KB
137 KB 320ms
319ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/tkpMXt58RPPtXb06qhV9GQYtTuA=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357f90db28.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: 992c3b7f9e36464e9e12189dc404c5c781bcfbc7d65d0a1d9398b30d4b33913d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "b100697c5dac621559ab2422a8a4c110fc60e75a"
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:19 GMT
x-cache: Miss from cloudfront
content-length: 139906
x-amz-cf-id: jwgfshtVolVfsbRkAl_QOMLfKHTxmCH7kxJ8VNbPVHAob29xNds01Q==
date: Sun, 11 May 2025 05:19:19 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 615357fadba2f.hires.jpg
thumb.spokesman.com/Lwy5WX6YEbFfh5Dc51CHBN0OtNU=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 136 KB
136 KB 384ms
383ms Image
image/webp 52.222.236.129
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/Lwy5WX6YEbFfh5Dc51CHBN0OtNU=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357fadba2f.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-129.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: ca0ba71b383a70dfd62c73bd1676f387fc57f5dff42c2b805f5ab594114bce52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "d181542597a4422fa63519862702a4457a9621dd"
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:19 GMT
x-cache: Miss from cloudfront
content-length: 138944
x-amz-cf-id: zXMSo4WoPv0Y6raQ82Mtn5pwBwOJbROdm--K-Bryz14aOLf3-sBGjw==
date: Sun, 11 May 2025 05:19:19 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 loader.min.js Show response
cdn.wgchrrammzv.com/prod/spokesman/ 38 KB
14 KB 308ms
88ms Script
application/javascript 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sites/spokesman/js/noncritical.min.e3d124e9151c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 563f81beb3f77223df0b04738213c7b911d686c367c85850ef4ca5245aabd087

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-type: BlockBlob
cache-control: max-age=43200
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-azure-ref: 20250511T051919Z-15cb6b8966cjkq5xhC1BERy17w00000008d0000000007204
x-fd-int-roxy-purgeid: 46
content-encoding: br
x-ms-request-id: 40503762-801e-003f-4f06-c03f1d000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 13 Jan 2025 06:51:56 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
454 B 52ms
51ms XHR
text/plain 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=93240116&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=pl-pl&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACACI~&jid=1765243672&gjid=1198495360&cid=1273096636.1746940759&tid=UA-230256-14&_gid=1415888464.1746940759&_slc=1&gtm=45He5571h1n715P9SH6v71896582za200&cd1=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&cd2=nation-world&cd5=2021-09-28&cd7=News&cd8=979335&cd9=story&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&npa=1&z=1772743707

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
393 B 84ms
84ms XHR
text/plain 108.177.15.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-230256-14&cid=1273096636.1746940759&jid=1765243672&gjid=1198495360&_gid=1415888464.1746940759&npa=1&_u=YCDAiEABBAAAAGACIAC~&z=750840069

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgdc:149:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgdc:149:0
content-length: 1
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
71 B 115ms
115ms XHR
text/plain 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=93240116&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=pl-pl&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAAGACIAC~&jid=976596927&gjid=2125926427&cid=1273096636.1746940759&tid=UA-230256-14&_gid=1415888464.1746940759&_r=1&gtm=457e5571z8869949972za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=521977008

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:19 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
376 B 115ms
115ms Image
image/gif 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=93240116&t=event&_s=2&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=pl-pl&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Preferences&ea=color_scheme&el=system&_u=YCDACUABBAAAAGACIAC~&jid=&gjid=&cid=1273096636.1746940759&tid=UA-230256-14&_gid=1415888464.1746940759&gtm=457e5571za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=429589060

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 47356
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 16:10:03 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
94 B 113ms
113ms Image
image/gif 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=93240116&t=event&_s=3&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=pl-pl&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Preferences&ea=system_color_scheme&el=light&_u=YCDACUABBAAAAGACIAC~&jid=&gjid=&cid=1273096636.1746940759&tid=UA-230256-14&_gid=1415888464.1746940759&gtm=457e5571za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=1124544928

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 47356
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 16:10:03 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 571ms
131ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&artid=979335&artpubt=1632852480&artsrc=Associated%20Press&arttype=metered&artupt=1632887331&auth=Maria%20Cheng%7CAl-Hadji%20Kudra%20Maliro&hier=News%7CNation%7CWorld&ptype=story&prem=metered&pubname=The%20Spokesman-Review&sec=News&wrdcnt=927&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=2f5e9d7f-d45d-4399-9c09-2dcaa150060e&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940759317&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x4943&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTc0Njk0MDc1NzQ5MyIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMS45bWIiLCJoZWFwVCI6IjE1LjJtYiIsImZzdFBhaW50IjoiMTE4OCIsImZldGNoUyI6IjAiLCJkb21haW5TIjoiMSIsImRvbWFpbkUiOiIzOSIsImNvbm5TIjoiMzkiLCJjb25uRSI6IjEzNyIsInNzbFMiOiI2MCIsInJlcXVTIjoiMTM3IiwicmVzcFMiOiI4NTAiLCJyZXNwRSI6Ijg4MiIsImRvbUxvYWQiOiI4NTQiLCJkb21JbnRlciI6IjExNzMiLCJkb21Mb2FkUyI6IjEzNjIiLCJkb21Mb2FkRSI6IjEzNjMifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiIxMjczMDk2NjM2IiwicmVmVGltZSI6IjE3NDY5NDA3NTkzMTYifV0sImNhdGVnb3J5Ijp7ImNhdGVnb3JpZXMiOltbIk5hdGlvbi9Xb3JsZCIsIldvcmxkIl1dfX0
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:19 GMT
Content-Type: image/gif
Connection: keep-alive

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 226ms
100ms Fetch 18.159.212.21
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.159.212.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 226ms
100ms Fetch 18.159.212.21
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.159.212.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 225ms
99ms Fetch 18.159.212.21
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.159.212.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
124 B 223ms
98ms Fetch 18.159.212.21
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.159.212.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 81 B
470 B 332ms
145ms Fetch
application/json 52.209.86.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.209.86.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-86-237.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: b442b9c90f01fbe2f938a6bd923f5f98b498b40badd2c4fd0dcad794114b1006

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.spokesman.com
content-length: 106
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 475 B
796 B 260ms
125ms Fetch
application/json 63.215.202.146
VCLK-EU-SE Conver...

General

Check archive.org

Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.215.202.146 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE Conversant LLC, US),
Reverse DNS: ams01-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 16ed4d18a5b47da1ff058ebc498f4afe543c488e01f142f2afb60f334fdfa9db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.spokesman.com
content-length: 475
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: nginx

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 299ms
125ms Fetch
application/json 89.149.192.192
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.192 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
442 B 278ms
103ms Fetch
application/json 89.149.192.192
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.192 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 298ms
124ms Fetch
application/json 89.149.192.192
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.192 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 05:19:18 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 359ms
184ms Fetch
application/json 89.149.192.192
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.192 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
281 B 445ms
154ms Fetch 152.42.155.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.155.191 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 05:19:19 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 542ms
252ms Fetch 152.42.155.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.155.191 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 05:19:19 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 505ms
215ms Fetch 152.42.155.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.155.191 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 05:19:19 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 443ms
155ms Fetch 152.42.155.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.155.191 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 05:19:19 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 473 B
1 KB 212ms
103ms Fetch
application/json 185.89.210.122
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0497cc0bcf324fbc1eb739bd2f79f0afe356bbad0e1732622c5792775d2eef91

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.161.163; 146.70.161.163; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
an-x-request-uuid: af2d05f3-8702-4b43-b27e-45f9e7a29976
content-length: 473
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 11 May 2025 05:19:19 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
492 B 228ms
105ms Fetch 178.250.1.38
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.26.0&cb=84005096799&lsavail=1&networkId=12005

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.38 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:19 GMT
vary: Origin
server: Kestrel

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 715 B
685 B 318ms
190ms Fetch
application/json 34.1.1.166
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageReferrer=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&CanonicalUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.1.1.166 Paris, France, ASN15169 (GOOGLE, US),
Reverse DNS: 166.1.1.34.bc.googleusercontent.com
Software: fasthttp /
Resource Hash: 2cef469e089a57eed9dc5bc2a1d85e710e6dc78a6b827289bf38867078509218

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-max-age: 3600
content-encoding: gzip
x-kong-request-id: 5d0f962878aa8d1510683a00b843e607
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS, POST
via: kong/3.6.1
x-kong-upstream-latency: 140
access-control-allow-origin: https://www.spokesman.com
content-length: 287
date: Sun, 11 May 2025 05:19:18 GMT
x-kong-proxy-latency: 1
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: fasthttp
access-control-allow-headers: Accept-Encoding, Content-Type

POST
H2 200 adreq Show response
ads.servenobid.com/ 616 B
702 B 238ms
106ms Fetch
application/json 143.244.197.139
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL

https://ads.servenobid.com/adreq?cb=5161

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

143.244.197.139 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Resource Hash

d8dbbbd487529ec5263ee6d39d97e2e919dc1c7b3e075dffaab7b5f4db89ee27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
access-control-allow-credentials: true
amp-access-control-allow-source-origin: *
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
vary: accept-encoding

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 243ms
137ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU57RW71
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 1fd8651da4452b29620b594e1f0e28509bdbf93079e85a95d54297740603d7ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 69
access-control-allow-credentials: true
via: 1.1 google
expires: Sun, 11 May 2025 05:19:19 GMT
access-control-allow-origin: https://www.spokesman.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 552
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
177 B 346ms
186ms Fetch 163.5.194.37
SECUREDSERVERS-EU...

General

Check archive.org

Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 163.5.194.37 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, private, must-revalidate
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:19 GMT
x-envoy-upstream-service-time: 95
vary: origin, accept-encoding, Accept-Encoding
server: envoy
access-control-allow-credentials: true

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
629 B 208ms
99ms Fetch
application/json 52.222.136.15
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.136.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-136-15.fra50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: ab3df36974f582a3abb3c213becd606b9c36685c10bd92680c2caa9ccfb80242

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2cce65cc9ed94a08f98eec766e6667a8.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: tbIC4qMyonpZ78_QCGvyD1wXXmpoXHHJ98oaJLlxQPTJrjufLU9E0g==
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
x-amz-cf-pop: FRA50-P2
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

GET
H2 200 loader-config.json Show response
cdn.q0losid.com/prod/spokesman/ 3 KB
1 KB 311ms
87ms Fetch
application/json 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.q0losid.com/prod/spokesman/loader-config.json
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e0c3c1e9d6b575fee5fe7cfd2fc0c8731747221e25d451a23138b92d2b7d0d88

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-type: BlockBlob
cache-control: max-age=43200
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-azure-ref: 20250511T051919Z-15cb6b8966cd4j8phC1BERd85s00000008k000000000cncz
x-fd-int-roxy-purgeid: 46
content-encoding: br
x-ms-request-id: 6d30649d-801e-0062-7015-c03599000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
vary: Accept-Encoding
last-modified: Mon, 13 Jan 2025 07:01:59 GMT

GET
H2 200 support-local-journalism Show response
givebutter.com/embed/c/ Frame 1346 13 KB
6 KB 618ms
549ms Document
text/html 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d171ef8826ff1270d31583bc6e638435b6b382a31e67ed6a2da53c10eeb1004

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 93df38852d4fbf3e-WAW
content-encoding: gzip
content-security-policy: base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 05:19:20 GMT
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=31536000
vary: Accept-Encoding, Origin
x-content-type-options: nosniff nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-server: prod-app-i-089ad00bb53634080
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 Givebutter_H_Text.svg
givebutter.com/assets/brand/givebutter/Powered/ 15 KB
7 KB 119ms
50ms Image
image/svg+xml 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://givebutter.com/assets/brand/givebutter/Powered/Givebutter_H_Text.svg

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87b010edc18752647dcd8749bfe9abea7cb1eaf4f3ea4de0898b3ed325b1ed08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6025-3cb3"
age: 1985
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=qHGOIlJ46RcKqHRVJlJEej9dSfAIkRPaCqnb7cjL2GE-1746940759-1.0.1.1-h50jdpn8KTO4fICa5trjRWFMX2O91iPSmjWInegLZNHZUlZ1SfB4rGlkKM0dmAwOT9fIbKv6Rjbhr3ouHhOj4jHVVg2gyaU7RLX8CKyHUHDK2bqgi5PonJZpzPHZyxLaDPq2.7m41X.GYwh5uXHojA"}],"group":"cf-csp-endpoint","max_age":86400}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=qHGOIlJ46RcKqHRVJlJEej9dSfAIkRPaCqnb7cjL2GE-1746940759-1.0.1.1-h50jdpn8KTO4fICa5trjRWFMX2O91iPSmjWInegLZNHZUlZ1SfB4rGlkKM0dmAwOT9fIbKv6Rjbhr3ouHhOj4jHVVg2gyaU7RLX8CKyHUHDK2bqgi5PonJZpzPHZyxLaDPq2.7m41X.GYwh5uXHojA; report-to cf-csp-endpoint
cf-ray: 93df388529c7465d-WAW
date: Sun, 11 May 2025 05:19:19 GMT
x-xss-protection: 1; mode=block
content-type: image/svg+xml
last-modified: Fri, 09 May 2025 20:05:57 GMT
vary: Accept-Encoding
x-server: prod-app-i-0441c0725a3a7c356

POST
H2 200 recirculation.php Show response
events.newsroom.bi/recirculation/ 12 B
73 B 62ms
61ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/recirculation/recirculation.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df38850fc22a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 12
date: Sun, 11 May 2025 05:19:19 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
28 KB 286ms
74ms Script
application/x-javascript 13.107.246.64
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-lastmodified,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/x-javascript
vary: Accept-Encoding
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
cache-control: public, max-age=1800
x-ms-meta-lastmodified: 2020-10-01 19:31:04
x-ms-request-id: 3c0dc90e-801e-0007-5bef-bcacbc000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T051920Z-15cb6b8966c9t76zhC1BERxe8n00000008g000000000fv6x

GET
H2 200 fp.min.js Show response
cdn.a3kvau184uea.com/prod/spokesman/ 66 KB
27 KB 325ms
64ms Script
text/javascript 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.a3kvau184uea.com/prod/spokesman/fp.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a2fdfed84c31fff7b05803b3c1dc59a65956e4f0b1dbf13ce4b2340caa621c2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

x-azure-ref: 20250511T051920Z-15cb6b8966c8wm28hC1BER69w4000000085g000000005ds4
x-cache-info: L1_T2
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 16
x-ms-request-id: 9f7bf6a6-501e-004e-1306-c0d936000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:20 GMT
x-ms-blob-type: BlockBlob
content-type: text/javascript
vary: Accept-Encoding
last-modified: Wed, 26 Mar 2025 06:56:55 GMT

GET
H2 200 g2i.min.js Show response
cdn.sy57d8wi.com/prod/spokesman/ 225 KB
226 KB 263ms
75ms Script
text/plain 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.sy57d8wi.com/prod/spokesman/g2i.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 2f219207f3d6a30452c637cb2c1e1d2ffaf4852a0d55acf36ade1a47cf729640

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

cache-control: max-age=43200
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DD6C275F995574
x-fd-int-roxy-purgeid: 18
x-ms-request-id: 17e4c559-f01e-00b3-0306-c05713000000
accept-ranges: bytes
access-control-allow-origin: *
x-cache: TCP_HIT
content-length: 230422
date: Sun, 11 May 2025 05:19:20 GMT
last-modified: Wed, 26 Mar 2025 05:30:51 GMT
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T051920Z-15cb6b8966cn77mlhC1BERy22w000000084000000000a19y

GET
H2 200 t8y9347t.min.js Show response
cdn.e3fbosf1tz3d.xyz/prod/spokesman/ 1 MB
489 KB 294ms
103ms Script
application/javascript 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 15ff29496ac40d398a774a309adfc1777340b666b3d00474a368da343bf266d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

x-cache-info: L1_T2
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 75
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 29 Apr 2025 11:02:00 GMT
cache-control: max-age=604800
x-ms-request-id: fa5b2bcc-501e-002c-4762-be1b11000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T051920Z-15cb6b8966ckbwtchC1BERzgsg000000081000000000au93

GET
H2 200 t8y9347t.min.css
cdn.e3fbosf1tz3d.xyz/prod/spokesman/ 398 KB
72 KB 267ms
87ms Stylesheet
text/css 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.css?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 7a471672f3f91ad82285192cae07b7e06f4b2baddec73d8e6898a1a445f5d0ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-cache-info: L1_T2
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 75
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Tue, 29 Apr 2025 11:01:25 GMT
cache-control: max-age=43200
x-ms-request-id: 17ead650-601e-00a1-74fb-bf2cc3000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T051920Z-15cb6b8966c8wm28hC1BER69w4000000081000000000erqu

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 269 KB
37 KB 335ms
284ms Fetch
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=8884817808628495&correlator=4267578295544673&eid=31086815%2C31090593%2C31092338%2C83321073&output=ldjh&gdfp_req=1&vrg=202505060101&ptt=17&impl=fifs&iu_parts=1009641%2CSpokesmanDesktop_News_Top_728x90%2CSpokesmanDesktop_News_Top_300x250%2CSpokesmanDesktop_SideRail_100x525%2CSpokesmanDesktop_News_Middle_300x250%2CSpokesmanDesktop_News_Footer_728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%2C300x250%7C300x600%2C100x525%2C300x250%2C728x90&ifi=1&dids=adbridg_ad_adbdtlbtop_1~adbridg_ad_adbdtsiderailtop_1~adbridg_ad_adbdtsiderailros_1~adbridg_ad_adbdtsiderailbottom~adbridg_ad_adbdtbottomlb_1&adfs=1211021519~715260756~2024556104~3467408886~3552575421&sfv=1-0-44&fsbs=1%2C1%2C1%2C1%2C1&eri=1&sc=1&abxe=1&dt=1746940760026&lmt=1746940760&adxs=436%2C1236%2C1500%2C1236%2C436&adys=223%2C340%2C338%2C961%2C4288&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C1&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vis=1&psz=1600x101%7C300x0%7C100x-1%7C300x0%7C1472x0&msz=1600x101%7C300x0%7C100x-1%7C300x0%7C1472x0&fws=4%2C4%2C516%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600&topics=5&tps=5&htps=5&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1746940758347&idt=573&prev_scp=pos%3Dlb_top%26adb_imp%3DS105.1%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dsiderail_top%26adb_imp%3DS108.2%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dsiderail_sponsorship%26adb_imp%3DS100.3%2C1%2Clzs_dt%7Cpos%3Dsiderail_bottom%26adb_imp%3DS106.4%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dlb_bottom%26adb_imp%3DS104.5%2C1%2Clzs_no%26adb_bdr%3Dnone&cust_params=tags%3Debola%2520outbreak%252Csex%2520abuse%252Cworld%2520health%2520organization%252Ccongo%252Cunited%2520nations%26section%3DNews%26category%3Dnation-world%26adb_pvd%3Dt5a&adks=2339051370%2C2987418812%2C1176090967%2C1674678964%2C3630864184&frm=20&eoidce=1&gblpids=%2F1009641%2FSpokesmanDesktop_News_Top_728x90~%2F1009641%2FSpokesmanDesktop_News_Top_300x250~~%2F1009641%2FSpokesmanDesktop_News_Middle_300x250~%2F1009641%2FSpokesmanDesktop_News_Footer_728x90&pbbce=1&td=1&egid=59576&tan=7c446881-a755-4a47-b6bb-aba6e51e8bdf%2C7c446881-a755-4a47-b6bb-aba6e51e8be0%2C7c446881-a755-4a47-b6bb-aba6e51e8be1%2C7c446881-a755-4a47-b6bb-aba6e51e8be2%2C7c446881-a755-4a47-b6bb-aba6e51e8be3&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

21efb02b66643901471d3409a3a318a85a0623e6298bf467b10772a281a181db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: 6989514401,6983607020,-2,6989514401,5239133665
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138516438491,138515421162,-2,138516259059,138507153737
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
content-length: 37782
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/ Frame 37D2 7 KB
3 KB 195ms
70ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 05:19:20 GMT
expires: Sun, 11 May 2025 05:19:20 GMT
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 990ms
372ms Image
image/png 52.26.0.221
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2maj7f8ibUNTI1GHnci,FafRdvQOEw&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,te,0,1,1,1,1,1,0,0,0,0,1,0,0,0,0,5,5,5,5&b=a0&b=vK,1&b=I1,1H,1,2,:g3,4:,:s5:1h,:h1:1,1,6,,6,:r5s,:D,1C,,1,,7,3B,0::,:S77,:Rb,64,g:,:Rl,bQ,1S:,:Rd,Dz,x:,:Ru,QM,2Z:,:Rz,QX,2P:,:Rp,WT,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aJ,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,1C,,1,,7,3B,0:,:H,,,0::,:Cgq,:b,:Rb,64,g:0,,4v,,0:,:b,:Rl,bQ,1S:0,,47,,0:,:b,:Rd,Dz,x:0,,3Z,,0:,:b,:Ru,QM,2Z:0,,6k,,0:,:b,:Rz,QX,2P:0,,5Q,,0:,:b,:Rp,WT,2T:0,,44,,0:,:b,:Ro,1rf,2W:0,,5K,,0:,:b,:RJ,1NL,3e:0,,5F,,0:,:b,:RZ,2aj,3t:0,,3x,,0:,:b,:RX,2aJ,3u:0,,3H,,0:,:b,:RY,2aK,3v:0,,3T,,0:,:b,:R19,2cF,3x:0,,,,0:,:D,1C,,1,,7,3B,0:,:H,,,0::,:qgN,7,8,:D,1C,,1,,7,3B,0::&b=I8,1K,1,9,:g3,a:,:sb,c:1j,:h1:1,3,6,:sc,b:6,:r5t,:D,,,1,,d,5e,jW::,:S77,:Rb,66,g:,:Rl,bT,1S:,:Rd,DA,x:,:Ru,QO,2Z:,:Rz,QZ,2P:,:Rp,WV,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aH,3u:,:RY,2aL,3v:,:RY,2aN,3v:,:R19,2cF,3x:,:D,,,1,,d,5e,jW:,:H,,,0::,:Cgq,:b,:Rb,66,g:0,,4v,,0:,:b,:Rl,bT,1S:0,,47,,0:,:b,:Rd,DA,x:0,,3Z,,0:,:b,:Ru,QO,2Z:0,,6k,,0:,:b,:Rz,QZ,2P:0,,5Q,,0:,:b,:Rp,WV,2T:0,,44,,0:,:b,:Ro,1rf,2W:0,,5K,,0:,:b,:RJ,1NL,3e:0,,5F,,0:,:b,:RZ,2aj,3t:0,,3x,,0:,:b,:RX,2aH,3u:0,,3H,,0:,:b,:RY,2aL,3v:0,,3T,,0:,:b,:RY,2aN,3v:0,,3T,,0:,:b,:R19,2cF,3x:0,,93,,0:,:D,,,1,,d,5e,jW:,:H,,,0::&b=Ie,1C,1,f,:g3,g:,:sh:0,:h1:,:r5t,:D,,,1,,i,9G,pO::&b=Ij,1I,1,k,:g3,l:,:sb:1l,:h1:1,6,6,,6,:r5u,:D,,,1,,d,ff,jW::,:S77,:Rb,68,g:,:Rl,bR,1S:,:Rd,DB,x:,:Ru,QQ,2Z:,:Rz,R1,2P:,:Rp,WX,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aF,3u:,:RY,2aL,3v:,:R19,2cF,3x:,:D,,,1,,d,ff,jW:,:H,,,0::,:Cgr,:b,:Rb,68,g:0,,4v,,0:,:b,:Rl,bR,1S:0,,47,,0:,:b,:Rd,DB,x:0,,3Z,,0:,:b,:Ru,QQ,2Z:0,,6k,,0:,:b,:Rz,R1,2P:0,,5Q,,0:,:b,:Rp,WX,2T:0,,44,,0:,:b,:Ro,1rf,2W:0,,5K,,0:,:b,:RJ,1NL,3e:0,,5F,,0:,:b,:RZ,2aj,3t:0,,3x,,0:,:b,:RX,2aF,3u:0,,3H,,0:,:b,:RY,2aL,3v:0,,3T,,0:,:b,:R19,2cF,3x:0,,93,,0:,:D,,,1,,d,ff,jW:,:H,,,0::&b=Im,1G,1,n,:g3,o:,:s5:1m,:h1:1,7,6,,6,:r5u,:D,,,5,Ny,p,16U,12::,:S77,:Rb,69,g:,:Rl,bO,1S:,:Rd,Dz,x:,:Ru,QR,2Z:,:Rz,R2,2P:,:Rp,WY,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aE,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,,,5,Ny,p,16U,12:,:H,,,0::,:Cgr,:b,:Rb,69,g:0,,4v,,0:,:b,:Rl,bO,1S:0,,47,,0:,:b,:Rd,Dz,x:0,,3Z,,0:,:b,:Ru,QR,2Z:0,,6k,,0:,:b,:Rz,R2,2P:0,,5Q,,0:,:b,:Rp,WY,2T:0,,44,,0:,:b,:Ro,1rf,2W:0,,5K,,0:,:b,:RJ,1NL,3e:0,,5F,,0:,:b,:RZ,2aj,3t:0,,3x,,0:,:b,:RX,2aE,3u:0,,3H,,0:,:b,:RY,2aK,3v:0,,3T,,0:,:b,:R19,2cF,3x:0,,93,,0:,:D,,,5,Ny,p,16U,12:,:H,,,0::&b=GgN,1,:Kq,:kr,s,t,u,v:w,:kx:y,:kz:A,:kB::,:L1,8,e,j,m:&b=KC,:kD:&bi=Uym016REhpSa1,adbridg_ad_adbdtlbtop_1,1009641,SpokesmanDesktop_News_Top_728x90,728x90,0.05,1600x101,Ubf026REhpSa2,adbridg_ad_adbdtsiderailtop_1,SpokesmanDesktop_News_Top_300x250,300x250,300x600,300x0,Uyh036REhpSa0,adbridg_ad_adbdtsiderailros_1,SpokesmanDesktop_SideRail_100x525,100x525,0x0,Uar046REhpSa3,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,Uf4056REhpSa4,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,1472x0,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,pos,lb_top&bt=uKRzoqK&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.maj7f7cl.2T157&g=2T1ym&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.3tr.1.0&adbj=ka19maj7f8efj9u8&mp=0.3&adb_cm=t5a&txx=Txx1&rnd=1746940760035
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.26.0.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-26-0-221.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 782ms
199ms Image
image/png 52.26.0.221
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2maj7f8ibUNTI1GHnci,FafRdvQOEw&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,w7,0,1,1,1,1,1,0,0,0,0,1,0,0,0,0,5,5,5,5&b=I1,1K,1,2,:g3,4:,:s5,6:1j,:h1:1,3,7,:s6,5:7,:q0,1,2,:D,,,1,,8,5u,jW::&b=G0,1,:K9,:ka,b,c,d,e:f,:kg:h,:ki:j,:kk::,:Ll,1,m,n,o:&b=Kp,:kq:&b=Im,1C,1,r,:g3,s:,:st:0,:h1:,:q0,1,4,:D,1C,,1,,t,5r,oc::&b=Kp,:ku:&b=In,1I,1,v,:g3,w:,:s5:1l,:h1:1,6,7,,7,:q0,1,6,:D,,,1,,8,fv,jW::&b=Kp,:kx:&b=Io,1G,1,y,:g3,z:,:sA:1m,:h1:1,7,7,,7,:q0,1,8,:D,,,5,NO,B,17a,12::&b=Kp,:kC:&bi=Ubf026REhpSa2,adbridg_ad_adbdtsiderailtop_1,1009641,SpokesmanDesktop_News_Top_300x250,300x250,300x600,0.05,300x0,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,Uym016REhpSa1,Uyh036REhpSa0,Uar046REhpSa3,Uf4056REhpSa4,pos,siderail_top,adbridg_ad_adbdtsiderailros_1,SpokesmanDesktop_SideRail_100x525,100x525,siderail_sponsorship,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,siderail_bottom,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,728x90,1472x0,lb_bottom&bt=uKRzoHx&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.maj7f7cl.2T157&g=2T21f&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.3tr.1.0&adbj=ka19maj7f8efj9u8&mp=0.3&adb_cm=t5a&txx=Txx2&rnd=1746940760136
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.26.0.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-26-0-221.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame FFA8 0
0 91ms
90ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvdP4AygklsQtHnq5wayRPVhp4z4qCnicRSzd_z8SeTMuOnjPWzQ5n1w3BMPc3KjN8Ibh2SRA6HBZ3__31_Hyj3pFUqy162XJEOY96ndIKMl86WSB71KAkLJTaL2ySHDQA6i8s4G8VawpmvnazQqvzcWApGi-euJfR1YHX6c9Q_Lf32odWDD8_xT_9-HKpdBuM4166TMbUwGqXhTi_uwrg8VIkGrbxJZ4tqvUIQ2gwYJUSuIntENMVVSxUNKZN0x0AwRtabJpdb7SsoMjllYdZw9bEnx4qtHHpGRIARLMdY5Urf-R1SS8hqbwNq93kns5rppbdUVTLzFijymD2Dt5IdlMyiscr33VYe7lWwDrP-e4SrRx-oZmTzkjWrcJcJQR-i2ak2D9yduhiey0va5hS4Jhco2ZiMtEZTJK2W8gii9dmgFWanGa3BjAuyb1oYajbmZz6q&sig=Cg0ArKJSzJhEP8_fAC_vEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame FFA8 21 KB
8 KB 110ms
109ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 54382
x-content-type-options: nosniff
expires: Sat, 24 May 2025 14:12:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 14:12:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame FFA8 3 KB
1 KB 116ms
115ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 40462
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:04:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:04:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame FFA8 221 KB
68 KB 51ms
50ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1169
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 04:59:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 5914989898356024440
tpc.googlesyndication.com/simgad/ Frame FFA8 23 KB
23 KB 199ms
79ms Image
image/png 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5914989898356024440

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

49c2c0bb2cbd3a9ff860dc035f4cbfcd801cc89e7c33fc04f56e20dac73b59ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 59319
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 12:50:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 10 May 2025 12:50:41 GMT
last-modified: Tue, 06 May 2025 22:40:48 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 23157
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame E050 0
0 76ms
76ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsskRyg9Yy9xPJHhlz4jX9SkANPF1cQ-vfNjeH9NBSogPQRBzF0zM2kGhD8N_S2OpczYk2iBDyQZgekhqx9x7a0o7tbFraMk1ideBnwbaGzssKwMSRVfRcKf9zG7oxaRFWKKh_1NvmU8yiXGXiKWGm7iUSpQ4DHmv9uivzvnpR-UIUB2bTgaud5yv9j81GonCh9-8kuTLmAsE1wUGulNUgvqIm9IbiXJduUVczFTyev2cjJnfU1kkXDf8ez_-2t0TtGxhwZlByUezoVpHQ3ip40V7jEXLdRZMgS-ENcJJ1gk2ri7o9UlLyZh9wwIZAHbgYfAVFOxtCVYbW_5VIBzFQW-S1kN7amp2EO4w4DD95dAejOK0a1xbANnHEwqMIErouj98DPUA88HhKWmYn7qovqugP_ZQ3DrrrwGe7kvk6Wvqv7Fgm4Qio4Gz0CEdwwpQmKVsA4KLg&sig=Cg0ArKJSzPm7YIBc01PuEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame E050 21 KB
0 97ms
97ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 54382
x-content-type-options: nosniff
expires: Sat, 24 May 2025 14:12:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 14:12:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame E050 3 KB
0 103ms
103ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 40462
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:04:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:04:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E050 221 KB
0 36ms
36ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1169
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 04:59:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 10356007053379578677
tpc.googlesyndication.com/simgad/ Frame E050 80 KB
81 KB 155ms
50ms Image
image/jpeg 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10356007053379578677

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

10e7d0dca9977b835dfcf9775698cef2309ee50a823f797a74ebe5c9d95ae5a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 75199
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 08:26:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 10 May 2025 08:26:01 GMT
last-modified: Tue, 29 Apr 2025 21:31:39 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 82387
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame DA17 0
0 84ms
83ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvgID_48p6lltEIdOV0l1tp3EF8C-5x3porGVgHnQzxXYMlSD63NYNqXzN9vAYKK5hxAOtFZhr5E8kanHeDr9y2SK36yGyBsyfdDgWCLzUdBulDaySN-i7Ec4QjKChLgGFsq63kxWzE3t91i70tYC-BSN0M7yB_vNvy_vJjeErZDX1R_YfwkCE9sbTvBPyUtQj1UeiNkdvb3BYpiAKnQw64IdlikXFnDl2ORwr6M-zVsgNRuYX4a8J7rDQKvdDeAkOXD26Lerf7M8juTSw3dQs-YU9pSKmoHAARqFiInTA5MywUESalHuy7H1ATQ2QfuRHDYzU6xmcuGoz6VM2mcQdXcVKB7N9Z6t7kGqReDk1O6T95Zwaeb5WOnjYsIB8MAl-c2788E5jYtiIHrF2p62LagQEo5MfH5f-nbEr6rkHw94wDUHc5sjzOD2RLmx7HKYcgMzYeXdm5nA&sig=Cg0ArKJSzM0Q8DjIKmL9EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame DA17 21 KB
0 92ms
92ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 54382
x-content-type-options: nosniff
expires: Sat, 24 May 2025 14:12:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 14:12:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame DA17 3 KB
0 98ms
98ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 40462
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:04:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:04:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame DA17 221 KB
0 31ms
31ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1169
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 04:59:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 987791874107600869
tpc.googlesyndication.com/simgad/ Frame DA17 18 KB
18 KB 219ms
120ms Image
image/png 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/987791874107600869

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

368af165cf521e89c6e268f933db3b3f6f78dd648ce93112bdc07846faebcfdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 59319
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 12:50:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 10 May 2025 12:50:41 GMT
last-modified: Tue, 06 May 2025 22:40:48 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 18564
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame CA5D 0
0 79ms
78ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsu6HExPL0pv8xvAgsnHxcmvfOK4p-X4eF9cCdeH18vdOCSWDhawI1rYkHzAf1jRTaD_JHQ_1sAHCboTi8g1g_gTj1ijMb5_dJ6e_43L1SMkGJZ9OD9WqhuezhqBUoUIqSN7mK9oq1sLbX8zLfMSi4uy3qUF2TZ5q4zes7YB61-udTuutuEnjCt6I_3s4lan-p7YxPxt_ktR9zO1eqtRfScaDV_E5wULzas2rEbM9RDX1tkw4ihMkJMup9GRQ-MBa43_8jG49UpBb1DP7oEsnHgUpuIDcssV7I7easkk6OOOTJcspWCXyr9mVh6oW0r4rM5xNyDZU6sPC57lql2YA1qcrCV-PHOPVsIhTp1F29kBmhomcgReo4mDGhItvE5QF9qPgvh4SoX-tYpAWAmdfMHQ_TVEning2hUnD4qK-bmN4uOJn_jLBuGLR5-DV_eyq2eSnnNNx8eM&sig=Cg0ArKJSzHA-lVOb3Hm9EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame CA5D 21 KB
0 82ms
82ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 54382
x-content-type-options: nosniff
expires: Sat, 24 May 2025 14:12:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 14:12:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame CA5D 3 KB
0 88ms
88ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 40462
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:04:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:04:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CA5D 221 KB
0 22ms
22ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1169
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 04:59:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 7918437785718273760
tpc.googlesyndication.com/simgad/ Frame CA5D 85 KB
85 KB 200ms
113ms Image
image/jpeg 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7918437785718273760

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

13661e9e77aafe5724ae07f269af0d07ba03f56dfd7b00f467558759df836c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 53056
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 14:35:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 10 May 2025 14:35:04 GMT
last-modified: Wed, 12 Feb 2025 01:01:35 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 86810
x-xss-protection: 0
server: sffe

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 64ms
62ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746940758631&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&cid=1273096636.1746940759&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAAAAQ&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746940759&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&_s=3&tfd=2945
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/plain
server: Golfe2

GET
DATA 200
OK truncated
/ Frame FFA8 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90281ef24e372fc058be5b33cd53e1eb7a71ab69628a09056c9f9bfdcecbd426

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E050 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 702cc4f159ee23725d889b620b5cbabd15cf4b564ccee60309f63a717f20bbb9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DA17 209 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2714ccb688a226df01ec80ee38d396582b9a9d06a82cf54c65b3d0d29ac58619

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CA5D 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6de4a5b2222641061566d4db422c7053695da84228170aed2644012d97e4bdd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 239ms
239ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk4OTUxNDQwMSIsImVidXkiOiIzNzY3NDcwMDUzIiwiZWFkdiI6IjQ3MjQxMzA0MzEiLCJlY2lkIjoiMTM4NTE2NDM4NDkxIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF83Mjh4OTAiLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=e78e5ea5-e31f-4577-8ec9-fc84cc983d3d&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940760457&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x5049&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:20 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 1346 248 KB
89 KB 201ms
87ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-75318216-1

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

8a5df07b019d5219014549abbca3d4cea8d07bd8983cef6165923909d5f62b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 05:19:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 90413
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

api.js Show response
challenges.cloudflare.com/turnstile/v0/b/701fd2559006/ Frame 1346
Redirect Chain

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback&render=explicit
https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js

47 KB
16 KB

30ms
30ms

Script
application/javascript

104.18.94.41
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H3
Server: 104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: caa976b62fb6b8808a12c08ee3434d1b41d614d404674fd4a3fd7c0528c923f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

server: cloudflare
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding: br
cross-origin-resource-policy: cross-origin
cf-ray: 93df3889fec434ee-WAW
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 05 May 2025 16:10:46 GMT
vary: Accept-Encoding
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location: /turnstile/v0/b/701fd2559006/api.js
cross-origin-resource-policy: cross-origin
cf-ray: 93df38892e4b34ee-WAW
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Sun, 11 May 2025 05:19:20 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 main.DDE89l1r.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 96 KB
17 KB 203ms
87ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9ebb8350799ffcdbd1143898dddc93a350fe53e2d790773a2510f9618966753

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"4e503fda0e211f240cc5a4f2e2634f27"
age: 80
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ymkbSZTlfpqfSznzyzhrR0OmWZLaQHFl3Ohd3qBIoYmNg4jnamDYVP2DsicS845mbOPg9q135eutVVsbJufK1itj%2FzdcJO4ulzaa1sCAle%2BxTm7VTEBSBvTqRhGeIByEe7Rw"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889e8d6dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14826&min_rtt=14712&rtt_var=122&sent=35&recv=22&lost=0&retrans=0&sent_bytes=28188&recv_bytes=3024&delivery_rate=1347076&cwnd=256&unsent_bytes=0&cid=9a90818b262bf62c&ts=105&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Wed, 07 May 2025 23:01:53 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 commonv2.ClJS35ba.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 8 KB
3 KB 183ms
68ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/commonv2.ClJS35ba.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67d0bdfdfd7aeda525143a544eae4164b01310d19d62149cd5d37304f0b42e51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5d920c4d4a05814c93fba318b55653f8"
age: 675
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pd4iWT%2BF9nffC9O3QVNJK7SqNZGdEmmEisITWRKqDCtCfgnmPJx8gMKLnRRGvD53v7UBeJXjZCdlCGGWfDmSOrwE2jY0yN47g2f1jH%2FAvg8BleNlRAyNnOgW9obh7uogpOe6"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b8dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=19&recv=9&lost=0&retrans=0&sent_bytes=13585&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=31&cid=9a90818b262bf62c&ts=88&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Wed, 30 Apr 2025 16:56:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 form.DsAxL8V8.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 2 KB
1 KB 177ms
62ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/form.DsAxL8V8.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00c99b5a5a184a82850f69d54e2b4fc68135b6fd3da3c9797033c50570a72c18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"4a73e33667a15fd3820a7fec1f7d9902"
age: 6280
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gIHH1FJbd%2BKC3xfTlUrB58pEV%2BSrTtyz55qKbUZ74DV%2FNsSf2R05mbxOANAcpOo2IknlSPeaEBCLtS7ly3hI7lTV1N9KXqCzJ6T%2FvcgJPSCrPE%2BweEU18ibL6LrQYihIoeKE"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b9dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=12&recv=9&lost=0&retrans=0&sent_bytes=7741&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=31&cid=9a90818b262bf62c&ts=88&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Sat, 03 May 2025 01:03:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ Frame 1346 559 KB
156 KB 249ms
142ms Script
text/javascript 216.58.212.170
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

15b386505eda43b9e2cec7f2a8864e16d81c419883a9b71967c5267e0006a23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: public, max-age=1800, stale-while-revalidate=10800
timing-allow-origin: *
content-encoding: gzip
etag: 79428b19
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 159694
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
vary: Accept-Language, Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H2 200 c37fafd8d9.js Show response
kit.fontawesome.com/ Frame 1346 16 KB
6 KB 131ms
54ms Script
text/javascript 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://kit.fontawesome.com/c37fafd8d9.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05f8e18ff6cfd0f6301a221842c6b541261607caa65edbb1d93c69d3f5001e2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

access-control-max-age: 3000
x-request-id: GDYqdPstzEF9NJzyNuvC
cache-control: max-age=60, public, stale-while-revalidate=30
content-encoding: gzip
cf-cache-status: HIT
access-control-allow-methods: GET, OPTIONS
cf-ray: 93df388ac9c9028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/javascript
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
server: cloudflare
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token

GET
H2 200 latest.js Show response
js.givebutter.com/elements/ Frame 1346 192 KB
53 KB 397ms
385ms Script
text/javascript 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js.givebutter.com/elements/latest.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb128d11873821d66616bc81a3229f7b664483472e52213dc15e39e5716d6dcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

x-amz-id-2: AauxZ/AbOHn4EgkKE0kNogJTuwBEWhtUmTui3P4JMyfMbD3PVtBGEhNPQnvHR85SLJKsu8zuuvs=
cache-control: max-age=60
content-encoding: gzip
cf-cache-status: HIT
etag: W/"333ffe903e9eccafc61523aea47190a9"
x-amz-request-id: R9AG0Z9XB4XDPMKD
cf-ray: 93df388a58ccbf3e-WAW
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 28 Jun 2023 20:29:40 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 1346 3 KB
2 KB 85ms
42ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

11b98a9c0c860d3d72181a89a029a7ce9ea9a9074aa8f6d5dc37841e082f10ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

content-md5: CcxHKpT30l9OSQHR9jJ3RA==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "e426efe077b4b1ddd449567abadf5b09"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:38:56 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 122e86e1952edb7e2517bee0c30228b2
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=23, mss=1232, tbw=4811, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: KseYmYAjtejptCE/Wf3SuWvZljdpmyyH3mfL/BgPdVqRONP0sQ7mnp23xhCFqvg63eG2aOBnRuRFMpnCWaE5rg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1689
origin-agent-cluster: ?1

GET
H2 200 / Show response
js.stripe.com/v3/ Frame 1346 740 KB
177 KB 193ms
66ms Script
text/javascript 13.32.99.78
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.78 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-78.fra60.r.cloudfront.net

Software

Cloudfront /

Resource Hash

19abc0bf04517d277a8159f6df85d62bdaae81c51e9c9b4f4392202ddee40b05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
etag: W/"99ec8c39e4284db6d3d699207cc77c36"
age: 17
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: qCD4knLdnAj8UXQ7GLlLuvYI7-JRK8e_U5FPk8sIT9kwW-Jhm-xCUA==
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/javascript; charset=utf-8
last-modified: Sat, 10 May 2025 01:45:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=60
timing-allow-origin: *
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P3
server: Cloudfront

GET
H2 200 link-initialize.js Show response
cdn.plaid.com/link/v2/stable/ Frame 1346 157 KB
44 KB 196ms
81ms Script
text/javascript 13.33.187.112
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.plaid.com/link/v2/stable/link-initialize.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6effd8b04358306dbc5dd017fa15e822ebe2ab13ca09489b6abccafe40287789

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
x-amz-version-id: YuyGl9Rkq4TbskCR9kK716nqoK9UkKbt
etag: W/"525aea0aa1563984291616279622819e"
age: 10755
x-cache: Hit from cloudfront
x-amz-cf-id: VIgcWPOWX7e4BNkZ8iVokk3gCIIusSugNOc4F7_dMEJkwbkqYpJ_vA==
date: Sun, 11 May 2025 02:20:06 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Fri, 09 May 2025 23:01:03 GMT
x-amz-id-2: w2v0lXXBLf0mS2oBrKkUiloXSovCU+wd5KwmoqTHIvhQIlrhZI4J4dcAnxGQ1jcCAzQ07lWByCDfns1rRsecxA1J2LwV1bR3rGanPWtopL4=
x-amz-replication-status: COMPLETED
cache-control: no-cache,must-revalidate,max-age=0
via: 1.1 4770dda4e92393e930d8a34dcbb04db2.cloudfront.net (CloudFront)
x-amz-request-id: FDFZZVSKWBX70JWA
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 client.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame 1346 38 KB
11 KB 172ms
49ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/client.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.2.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

851d3d9028e7f9b70c04b2e1a1c32b99e68f59395c95cc0e691cb1bb2fa7d4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: cdfac6ece3982
content-encoding: br
etag: W/"6633f9a1-96d0"
x-content-type-options: nosniff
traceparent: 00-0000000000000000000cdfac6ece3982-d3972a467a835c03-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc1000105-SJC, cache-fra-eddf8230134-FRA
x-cache-hits: 2, 2431
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746940761.610855,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11302

GET
H2 200 paypal-checkout.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame 1346 58 KB
15 KB 172ms
49ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/paypal-checkout.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.2.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

478eb7d52d6939db24f8e7bec9738452f26be903f33d085272fe96aded025c9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: 55c9b77adc851
content-encoding: br
etag: W/"6633f9a1-e94d"
x-content-type-options: nosniff
traceparent: 00-000000000000000000055c9b77adc851-3d6d972af9d937c4-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10065-SJC, cache-fra-eddf8230134-FRA
x-cache-hits: 22, 2341
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746940761.610778,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15279

GET
H2 200 venmo.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame 1346 84 KB
21 KB 171ms
48ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/venmo.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.2.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4fda72116dacabbed70d130340385957ac9da610a6fb1938f4433ee40e47bdc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: a6c7b5c593cad
content-encoding: br
etag: W/"6633f9a1-14fcd"
x-content-type-options: nosniff
traceparent: 00-0000000000000000000a6c7b5c593cad-0da4f20fe6e8600f-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10056-SJC, cache-fra-eddf8230134-FRA
x-cache-hits: 24, 0
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746940761.610763,VS0,VE1
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21415

GET
H2 200 data-collector.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame 1346 29 KB
10 KB 172ms
50ms Script
application/javascript 151.101.2.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/data-collector.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.2.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a761989d03c3bc3c4f54e5b249fa4616c9ef6a3bac072d02789f69d44b2db102

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: 6ebdcfe6fe1bf
content-encoding: br
etag: W/"6633f9a1-754a"
x-content-type-options: nosniff
traceparent: 00-00000000000000000006ebdcfe6fe1bf-69cb92f2a92a66eb-01
dc: ccg11-origin-www-1.paypal.com
x-cache: MISS, HIT
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10065-SJC, cache-fra-eddf8230134-FRA
x-cache-hits: 0, 2370
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746940761.610710,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9900

GET
H2 200 Flow.jfKK7Jd7.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 7 KB
2 KB 174ms
60ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Flow.jfKK7Jd7.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e36eef9fe41a6a81c62d8cadddeb7ef0c904dfc0fa1b6deff3314ef610f45a0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"281236cc0bbc2ccb98ef6419121334d9"
age: 674
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GK45M%2BAy53c%2B6aqC%2BJ5wVY6ak78MY%2BTCVsc%2BUaPo9KLPITHN2QdOGNiZQhZnlgDyqx2dFwbkTDV5L1rgYuftlDYTQKK1P%2BIsytd%2BLM4cpbx%2Fofl5am8XSl%2BVqq8AfFdqrGjz"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8acdbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=7&recv=9&lost=0&retrans=0&sent_bytes=4016&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=87&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Wed, 30 Apr 2025 16:57:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 globe@2x.BMLb_Dmm.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 18 KB
4 KB 177ms
64ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/globe@2x.BMLb_Dmm.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eea91a5722b6b36943fa218f20242fdb98bf41a350e75204765b2f843164ad25

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"316375b2b5ae6dfa093e9fde79fd777c"
age: 4824
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jRObn55RHnkGODSccLt5K8ZjDnYqsEaFnYVSfaqlLFMwouDqusfyS%2B5JOzW%2F8E5Sv30%2F4Ji9%2BcIbWht52RqXvMRkZiU4iPWTXJVWydXeuQny72Kg5kJ12MCerlHQ%2FMk3QyGR"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8addbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=15&recv=9&lost=0&retrans=0&sent_bytes=9156&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=88&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Mon, 14 Apr 2025 14:20:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 LabeledPhoneInput.BWfWM5bO.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 17 KB
4 KB 195ms
82ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LabeledPhoneInput.BWfWM5bO.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3dda5d66b2884ca37dda8bbfe1e77a3d088f181d068aa17cdf0d2f21ca9765cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"abe87c41727630353290b705e0c0d299"
age: 3868
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IROefUvruXIQPlW9tagYrpATPZdwh%2B9q0K6hzK%2FLIOrubAW89mOZ73zk9Nki51CJhZ7jONCd1YkpXnjBMwWANH%2BWKlSErM9QW252q3VQJTHH7gbQwWIy7sYT%2Bp4jRPT2ohUH"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b5dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=27&recv=9&lost=0&retrans=0&sent_bytes=20823&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=89&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Thu, 17 Apr 2025 22:10:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 PaymentAccordion.BzkDk5MU.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 163 B
781 B 180ms
67ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/PaymentAccordion.BzkDk5MU.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c24a1ab5a36b5ab1827da8c3fa51348be759febeaf3c67fbf46946cd08e0a4aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"45cf7dae05dbdf57f6e01685ce00a242"
age: 5191
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uplrJTVvybaXmZUlioU7KR4ImmNjuGdx9oA6L27Rh6zW67ttkYe1UEjSsFNN8k0VgPEIL8%2Bibkriibw4ulFZJHcoLuHQqFeZJ6IAXg8eJAshQXUBNOKuie%2BY2b420bakc6DK"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b4dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=22&recv=9&lost=0&retrans=0&sent_bytes=16781&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=88&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Tue, 08 Apr 2025 17:37:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 LinkShare.Cl28zoGY.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 2 KB
1 KB 175ms
62ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LinkShare.Cl28zoGY.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1ce556665f40cf05d19b34b433fbcf4617673a73ee960beaee64405a3f6dbf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"fc5e11033898defa518d86b4d47b60d8"
age: 3208
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZbKqr2%2BuiRhY8e%2B6TZE2zuDu5I%2BE7zXVYWZw7A%2BbogkIHD8XoA%2FR0G48R4v%2FED6RWvDSjDZoFuuI2xDlWszBYtZkrXS5z%2Fl61QY2CVGLyFt1qXqG0D9bJkqNEBq21LrCPwgG"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b0dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=10&recv=9&lost=0&retrans=0&sent_bytes=6435&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=88&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Mon, 21 Apr 2025 21:00:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 emoji.26suwpww.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 9 KB
3 KB 180ms
67ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/emoji.26suwpww.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b346830ae8412dee5e7b821cf164d9cbc443ffdd606baaa37b2ef397aae14975

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"07f19d9bb489168f49611cd681630e33"
age: 1488
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jFhsitaqRk4Oi%2FXla%2BSrdRI4SGh0twczdKhXELbnNbVFGSY4ed3JM9qS0OPN7%2FaUSYVXZ%2BDAhjKehb4Ny4DA4pjaiQwhcqhbbuCnuKVbjjyRlKxkA2QalcYrrVdpOUHBcorH"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889d8b3dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14754&min_rtt=14712&rtt_var=2357&sent=24&recv=9&lost=0&retrans=0&sent_bytes=17628&recv_bytes=2861&delivery_rate=293751&cwnd=253&unsent_bytes=0&cid=9a90818b262bf62c&ts=89&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Mon, 21 Apr 2025 21:00:15 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 Svelecte.DIf5qRu2.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame 1346 7 KB
3 KB 197ms
85ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Svelecte.DIf5qRu2.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1a265736848ddd027d8f640c0078da748d36604187ff08b55b9b8edab3f8f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"c3c9ed092294453bf977f27510c4f095"
age: 4658
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bTyypHRHCeZD8513mk84MBP6aBFzqI%2ByZX0807JOf7xgIsUHVyM5X44XuTzrW6tT%2FI7ZKg62BKrqWb3AbtJbx6SRm0ICIhvt%2B7n54Vgfr%2FBgEcaFp33H6mHCN9dQzPGS2hZ4"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889e8d8dbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=14753&min_rtt=14712&rtt_var=1769&sent=32&recv=10&lost=0&retrans=0&sent_bytes=25339&recv_bytes=3024&delivery_rate=293751&cwnd=254&unsent_bytes=0&cid=9a90818b262bf62c&ts=101&x=0"
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/css
last-modified: Fri, 11 Apr 2025 16:40:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 embed.lFim9v84.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 1 KB
1 KB 1236ms
136ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/embed.lFim9v84.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eafde1b9321c5218874c0c1058664721eaa0c69a6846fed417c392cd3c0d5418

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"01aed928ebd8f1e66a38b499a8608527"
age: 983
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oyq4XP6%2FzRImKOG5fzzsHDlBwWuSpFsLQxdeOgJMUlLw%2FsfyEDY0a3CFbR6DbiGZJEOcUgcwHWxBz4ue5lJ07QLBteskdw0gqUcGqnLLadd3dj6IQcoHqL9zJ5DnMeTcAqYg"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902916dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18587&min_rtt=18565&rtt_var=2218&sent=63&recv=10&lost=0&retrans=0&sent_bytes=79763&recv_bytes=3674&delivery_rate=233498&cwnd=254&unsent_bytes=37648&cid=b0c0c7bae192c514&ts=89&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:08:07 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 Flow.BPkqgaF8.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 306 KB
74 KB 1246ms
147ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Flow.BPkqgaF8.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad494e9aacbcc5547f12c8293d92fa47e9e3597fe246bacc1f57efd2b400b437

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"04de9b73eda95f2bf3c691c36889b13a"
age: 3153
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pREz%2BTY5qgWhFPbFlUgrUhZLkX9tjeL1F7lSdgvLBAX%2BIEKs9LsvNTawmovC2h2BuEWQgBRYCHiI97fzpAj9r8u19yB7Q5GkvZfgImiCQbjBkYVze1n3fx%2FSOV6KqsfKpc6o"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902915dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=94&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:08:05 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 EventTicketsFlow.Cq-UwxQ1.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 17 KB
7 KB 1168ms
68ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/EventTicketsFlow.Cq-UwxQ1.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d890e2e4c70263205b52c10bac30491c0d7a13ebe5b3ee1123825eade66d097b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"039fcf71f4321e92167ca339dab99c8f"
age: 1488
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=USER2yXPpelXKiqkEDXxtZ9Jq3oyeXCm4se6y16QlxKv7XUu1EUVZgL8u4gEa%2BMr0vp9K%2FBqldOmhQ7XLJNrdHXOsa9RAh1EZM9h6ICa9tb96B36tWGTxQfKfZQJOq0obyM6"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f1dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=7&recv=9&lost=0&retrans=0&sent_bytes=4018&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=0&cid=b0c0c7bae192c514&ts=72&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:07:13 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 globe@2x.Btpk9ooJ.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 101 KB
35 KB 1234ms
135ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cc88e309177d92c0dbc370458cf4739082e37e2b988c50a8002a1433c052593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"8bc23b922982b2c71be7b6cca0729899"
age: 113
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LwlMykzUgD62yF2r2Pra3VoqMznlzmyTjHT3QKa%2BkbzpW9np9%2B2WJlGlRdPQacZOaf4ooIQ2ifKSLWmoet1J8XaAXDZAs%2BNQUPzGLz7mJeY%2F2qHjFI7LZd1AYfDqSwmYvKzN"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f5dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=63&recv=9&lost=0&retrans=0&sent_bytes=79763&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=37648&cid=b0c0c7bae192c514&ts=75&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:20 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 _commonjsHelpers.D6-XlEtG.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 731 B
1 KB 1173ms
74ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/_commonjsHelpers.D6-XlEtG.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c67d6a406ff72f17cfbbfaed1574f1ffce1d15c26c4496ebac83e606becda886

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"0314008884c7cb282d9aa919982c5718"
age: 3869
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qcd0kgrej8m5hVPQT4Kh3xHqhKYvmmhKymJ2iEYZMRGoWj%2FCIWfXhjhksky2z%2BW99jn0WSaP2L3ixozayesfB5%2F%2FKrIxRoIjh%2BjwSnsoEnCSZXYocM%2Br1imThgkijCysUogq"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f4dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=18&recv=9&lost=0&retrans=0&sent_bytes=17837&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=1264&cid=b0c0c7bae192c514&ts=72&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:19:54 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 ContactInfo.B2CUzmcH.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 20 KB
7 KB 1169ms
70ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/ContactInfo.B2CUzmcH.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94463d6613d2657c837b25ea591747d6ee86700dcaed5800f34591cf2230afb5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"dbc904a61573344752f764a5f4a5864a"
age: 81
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lLDWLiqSgOXaDCpY5t3JSo8bwnQaaGu21NvG3nTKwzSoBqS3lbHv60AT33U%2BJkrfHpnNO6IhPv4NgcIfex0Vl4t9MTH6A5dPb69vv142DB1f2zv7oal9eTMak9SO%2Bh8WUeBK"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f3dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=13&recv=9&lost=0&retrans=0&sent_bytes=11575&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=0&cid=b0c0c7bae192c514&ts=72&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:31 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 LabeledPhoneInput.DEqwDrCx.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 71 KB
22 KB 1189ms
91ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LabeledPhoneInput.DEqwDrCx.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df5ea2615f1e65c25f3100090d372768cecf9c0485138bb61c5ccee0a1f42f2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"7b7b0fa6605406af2db30ad1922d6710"
age: 81
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bisdPA1kfYz6mnGpwdTFNn3SHrgorCEKs%2FRQ4LQvlDT5CPw0Ut358tgdFu3AhfF7lVSUZylB5apkG8oNgv9%2BaUhQo4kqU%2FXfsbM%2BGaVho1xLDRDM5i65NzuF9H%2BtsSRCabSs"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f2dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=20&recv=9&lost=0&retrans=0&sent_bytes=20234&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=0&cid=b0c0c7bae192c514&ts=73&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:08 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 filepond-plugin-file-validate-type.esm.B_ANaPmy.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 105 KB
36 KB 1236ms
137ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/filepond-plugin-file-validate-type.esm.B_ANaPmy.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe6d410b84a3f94a20c4be9625ea8a41ec7f825e6e707ee6ee57d992f065cc5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"6a359d4c3a6bcb7c99930d8552f75403"
age: 3869
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=loEtaELlBctK9vNZdbEv8xFz%2F%2BJt7hPentA8tWIMZ2hs23WpEO6L1%2BKP6H7ZHiFO%2B9Qoja%2BJZCgZ0hdGHU9TaVrry0XXwApavgQPimFD1O8hCHq5d6PPayq22ZOhQCpOjF64"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902914dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18609&min_rtt=18556&rtt_var=107&sent=68&recv=21&lost=0&retrans=0&sent_bytes=86932&recv_bytes=3674&delivery_rate=1207350&cwnd=256&unsent_bytes=30479&cid=b0c0c7bae192c514&ts=91&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:37:04 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 index.DYVuyAVS.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 780 KB
59 KB 1245ms
147ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/index.DYVuyAVS.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 540be8c635852201795247d645c29293a6b7cb6d6fb05e22a8676b52d91fee19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"c9c50fb18232aed6ba2979c69b9f0e0f"
age: 6967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vECdxTiGknLHfLw5gTZ%2BZb%2BvJUckKorrWKBaZmfVgGcUtimXWCMNlbPLuFrBWqqxjaVlQewuBAQqH4u1PU%2F1%2B57dwilJ68wN9IktHLflxxFxExvP95Ir94fmw2AbI63yQyR1"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902912dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=94&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 18:28:56 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 numeral.B_3j-8rd.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 11 KB
5 KB 1234ms
136ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/numeral.B_3j-8rd.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56b197972b901062f7ddd1da69d3cba8213671539f5b04272818cfb385de5301

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"3921961247d7b82ea43090bdeeb47287"
age: 3869
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M7gUVnOePqxZEsdWy%2B7ddcRmwOCRy78QVFeRtRkgcdQb%2FFRH76cPLgMEjdrQpnv4D%2BcM6h4rZ5xgX9j3CL11G%2FCoGDybyQ%2FkcLjXt1bJsREY4XtjF%2FC4bjTSU6lHIzwSt9Fc"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902910dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18587&min_rtt=18565&rtt_var=2218&sent=63&recv=10&lost=0&retrans=0&sent_bytes=79763&recv_bytes=3674&delivery_rate=233498&cwnd=254&unsent_bytes=37648&cid=b0c0c7bae192c514&ts=89&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:36:41 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 PaymentAccordion.BfPQcHbS.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 75 KB
22 KB 1235ms
137ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/PaymentAccordion.BfPQcHbS.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2cd69554b92111a977a7dad5894fab189378b6a52b754021100b9ab11a34489

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"13f908bed7ff8a1bcce6582c22aa5d5c"
age: 6550
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yvi4yO18O4QH0qlkf%2B39XOSiaHdVZ1wpwa7lGHFBY1goc9HIGV4mNJ8yftk161RhkAxnlzU9HK9jmisFqOcynIfVcDj7NshxuPQSq71ykxu1MOeQu7Jp9puqRtk7syf55GbP"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3890290edcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18597&min_rtt=18565&rtt_var=1264&sent=68&recv=12&lost=0&retrans=0&sent_bytes=86932&recv_bytes=3674&delivery_rate=298936&cwnd=256&unsent_bytes=30479&cid=b0c0c7bae192c514&ts=91&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:06 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 LinkShare.BaRoQU2N.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 118 KB
45 KB 1200ms
102ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LinkShare.BaRoQU2N.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 297bd0260f572990cfa4545594c1510192ae33b78ec211ebb84aa74d79ceb1a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"00af9810169265a6cac0398c2a858e98"
age: 6550
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iqc5Bk5A03OtbMY0N2B%2BDuUwxKL0l%2BitiUAVsxQnudMBPgbCmJ%2F4swnULhOmkVhJzA01TfJPwaa10z53kB5xm5%2FFLJcGRHqJpx0kf8bdS4htdb5eqyWYBZPDzt1NSoUD%2BJp1"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f8dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=34&recv=9&lost=0&retrans=0&sent_bytes=39017&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=4110&cid=b0c0c7bae192c514&ts=73&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 emoji.DUOHsx9g.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 825 KB
151 KB 1233ms
136ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/emoji.DUOHsx9g.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0399699a7279e9e5c8b1fef1962029bdd83c8883e9ef314e5585cded68304f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"012476b199961e2c37b98843b930a4f5"
age: 6519
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNCtHKzaDsyqJ5gnviMvb9PxHX46xvX5eFrGCsUC%2BeEyCB7%2Bh9nyLO997bl0vpKd5QubIaBkWrqCibJtsHp0igAuyBuB%2FxTv1yLuji5o5%2F2zpIbhc8WiCN9om01wn25F%2BymP"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f7dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=63&recv=9&lost=0&retrans=0&sent_bytes=79763&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=37648&cid=b0c0c7bae192c514&ts=78&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:48 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 client.DZflzfXp.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 139 KB
46 KB 1224ms
126ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/client.DZflzfXp.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c118d1fca2998e4679455c91d4a0eb4a516d3d49bff9540bca8e3c6d21118a2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"d298586e7a26ca45c074b69588c526b9"
age: 2718
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qzgOYNGEjSfjHIOzTkvf83wpu606IvAgi998Q%2BBvo8rwb5%2BqF5mFTUa%2BpX%2Fsd19%2FNq1IPGQ0%2BMkFGL7EmPaABDuHoIyofcOonDdBzMklM5ULIpWq6F1%2FeQbD9o7uxMiNNJm%2F"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389008f6dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18591&min_rtt=18576&rtt_var=2948&sent=63&recv=9&lost=0&retrans=0&sent_bytes=79763&recv_bytes=2828&delivery_rate=233498&cwnd=253&unsent_bytes=9284&cid=b0c0c7bae192c514&ts=74&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:38:07 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 Svelecte.RSFjb1Xx.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 72 KB
27 KB 1244ms
146ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Svelecte.RSFjb1Xx.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a431b44f5dee485517960556b3400da39d89716fec8fa3d8691a66d3d42f8560

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5b473bc7e676a07ce6bbb0916333073c"
age: 6967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bG5JPyZBo6yXICslQOG9XTC8YDpZ7K8Aar%2BMpSvLkwNwGBWajS3WhuZemqWyfEXXfJaGqP8AWDXOq4Ujhb0Iby78DgjUcrhhcMxYwIJzV2mm5%2BcJAwzCO%2Fve861Ltzh1BOr0"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3890291bdcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=93&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:14 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 index.D4uN2bNE.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 121 B
644 B 1244ms
146ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/index.D4uN2bNE.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afc1b28f4f82c7ced1664c9fdf044c4a2570ed9e96da9ed548103b7a01000b08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"940b2e789d3a5626f224e214f29105fd"
age: 3869
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lmIKTjSuW4v%2FHApeyOX9Uk7aMUfJlkXqWZiyu3OLwFfsy8OH5BJN88TDIOrdtDpTRBGVvf3apUEaFlM94EE5vWL2ac6DxY%2B4OXs6rYE49iWwFeMOJVAb1%2ByGfbu8oqLdGHF6"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3890291adcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=93&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Thu, 17 Apr 2025 22:11:10 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 datetime.BpX6K-10.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 381 KB
102 KB 1245ms
148ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1395f9dfbc141826fbc67b90204496b4cc97d9ac6171ff4c88ace15abc649850

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5e6f3d53dfdaea0754d93264aad7335b"
age: 6229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BdqWgzcwQZo7XTPC9pf5A8tRCljJ17DpnTFMa8pr83ltzMun7hD9UvpJsVtY1wmcIuOSShrYy1%2BSu4imynxSEc5bDrbdnXv1zUSZHyYDmh87L%2FpswVttZqC%2Fl801UkPGRLkL"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902918dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=97&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:20:17 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 usePosthog.CpoFC8fX.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 176 KB
57 KB 1245ms
147ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0a863df8ff7675e7f475e64dcd92f6cb648e7c6953c2cb51aaea986a25d9ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"2764a7daaa24eedd86ad619dd402b276"
age: 5247
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FT0Mfj5M8pkTj7QIaBQ4KUaYR6EzmtOrh9UpPjR0di%2BisBeagUtWjhHkccVoOcG%2BDZAt2EZVOnghlIWD8EVhzFaO%2BRp8b9lQKz9gRDXhQ6k6a%2FPzWf27nNig4rpP%2FvWvIZVj"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df38902917dcc9-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=18647&min_rtt=18556&rtt_var=44&sent=115&recv=30&lost=0&retrans=0&sent_bytes=151880&recv_bytes=3674&delivery_rate=2655314&cwnd=256&unsent_bytes=8321&cid=b0c0c7bae192c514&ts=94&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:20:34 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 1346 19 KB
7 KB 103ms
34ms Script
text/javascript 104.16.79.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.79.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93df388abba5c05c-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:20 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 565 B
987 B 292ms
235ms XHR
application/json 104.26.5.15
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1746940760530
Requested by: Host: cdn.a3kvau184uea.com
URL: https://cdn.a3kvau184uea.com/prod/spokesman/fp.min.js?2025411
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86c9ff37ed0aeb828a6f1a889d0ac958e84e6f4d2317185fbc45a593b7ac156c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

server: cloudflare
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bg8MvUhvoOmJ4qI6k01MSNLg039vWwmXMP5gFydJqZi7O7rf51q43vMHrutT7%2FbJY5KgrsGOGbcxeLobq6%2Bwqbz7DTmytqDDpGwI1LCcJtunuWkBXcAXGfYqdbNp%2BfxKPakW"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df3889ce5337cb-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38024&min_rtt=37723&rtt_var=6487&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4258&recv_bytes=4436&delivery_rate=433&cwnd=12000&unsent_bytes=0&cid=85028021173aac6c&ts=240&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 05:19:20 GMT
vary: Accept-Encoding
priority: u=1,i

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA17 0
0 75ms
75ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA17 0
0 75ms
74ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA17 0
0 71ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFA8 0
0 130ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFA8 0
0 129ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFA8 0
0 128ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E050 0
0 187ms
69ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E050 0
0 187ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame E050 0
0 72ms
71ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvpBg8Yn130KvKx6NE8WnDwVKTPNkvmw8i6mNcy2KJdVhtok6qi2Jo-mcdDO6626shOymfMNZMwiuv31AhJFQCNfUzp_UCFCFBjOMK8764Uthf3GyvIbX9btdlbtVGUuuYGD-hmxaNNs2S950EcSIaNNThxlEaEvFZU8qgJ7kRsIIrZyqkf_Q_--s2wd7JjY4_nBVpMCXS61va-y5r3W1mNlMQOYwQRFVZLSEcDyS0hhnyGLSrgZRLoyZBrS1XLYmb53iCja_6djYgiZPBfx0jY5f0tJiZQ_QwJ_UXS4VpPXVRGYJaJa72qBnTNIF7UuDwnQzIG1XCuWh0xFMMEw9FPz_zlPlih9qXc_x1A76h_-OoQEiKtki8HLI9eOds7v5pZG0EdnXpERb3JUYwj6rw3ZOurP2RauJTqbg0OGKj5sJdNfqWgm6_uORx9w6Jw-T_q0OdIbLZf&sig=Cg0ArKJSzK73Fldf2b41EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E050 0
0 187ms
69ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CA5D 0
0 246ms
69ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CA5D 0
0 245ms
69ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CA5D 0
0 249ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 665ms
370ms Image
image/png 52.26.0.221
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2maj7f8ibUNTI1GHnci,FafRdvQOEw&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,19r,0,1,1,1,1,1,5,5,5,5,1,0,0,0,0,5,5,5,5&b=I1,1H,1,2,:g3,4:,:s5:1h,:h1:1,1,6,,6,:Q77,1,2,5,7,8,9,a,9,a,:D,1C,,1,,b,3B,0::,:c80,:D,1C,,1,,b,3B,0::&b=G0,1,:Kc,:kd,e,f,g,h:i,:kj:k,:kl:m,:kn::,:L1,o,p,q,r:&b=Ks,:kt:&b=Ip,1C,1,u,:g3,v:,:sw:0,:h1:,:Q78,1,4,:D2::&b=Ks,:kx:&b=Io,1K,1,y,:g3,z:,:sA,B:1j,:h1:1,3,6,:sB,A:6,:Q79,1,6,A,C,D,E,F,E,F,:D,1C,,1,,A,5u,jW::,:c81,:D,1C,,1,,A,5u,jW::&b=Ks,:kG:&b=Iq,1I,1,H,:g3,I:,:sA:1l,:h1:1,6,6,,6,:Q7a,1,8,A,7,8,J,a,J,a,:D,,,5,b,A,jx,jW::,:c81,:D,,,5,b,A,jx,jW::&b=Ks,:kK:&b=Ir,1G,1,L,:g3,M:,:s5:1m,:h1:1,7,6,,6,:Q7a,1,a,5,N,O,P,Q,P,Q,:D,,,5,NO,R,17a,12::,:c81,:D,,,5,NO,R,17a,12::&b=Ks,:kS:&bi=Uym016REhpSa1,adbridg_ad_adbdtlbtop_1,1009641,SpokesmanDesktop_News_Top_728x90,728x90,0.05,59HY87,46XV41,2rccRiH,7D1hZf,1600x101,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,Ubf026REhpSa2,Uyh036REhpSa0,Uar046REhpSa3,Uf4056REhpSa4,pos,lb_top,adbridg_ad_adbdtsiderailros_1,SpokesmanDesktop_SideRail_100x525,100x525,siderail_sponsorship,adbridg_ad_adbdtsiderailtop_1,SpokesmanDesktop_News_Top_300x250,300x250,300x600,57EbGw,46z25Q,2rc8AEa,7CCvcU,siderail_top,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,2rcc6CD,siderail_bottom,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,4ZlNuc,2wArYN,2rbzTUB,5IyRZT,1472x90,lb_bottom&bt=uKRzoHx&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.maj7f7cl.2T157&g=2T2ez&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.3w9.1.0&adbj=ka19maj7f8efj9u8&mp=0.3&adb_cm=t5a&adb_flag=lrc&txx=Txx3&rnd=1746940760624
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.26.0.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-26-0-221.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame FFA8 0
0 72ms
71ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuf7qmrKIMmydkCYGqEh6lBYIDxqqu3LQ8x2azzuf-HWpsyjNIzzZz5O8njkS9KaB4ocyH5u0EPTxDFUIhuqA7A-BvNE0c2666dc1HULoAT5f7jAKWgM_6gudVi830Ze39a_ZSFMtelstlyfCoPW0d3OeGUxZFteHTp0u99SQ_ULw-igblIHsWR3ZTfJ8FCsMWup2xqoqn6ezlRo6kOvLd7gsHVQdPY5C35NQYNCMRbJLmkRNvLILS657aJW7k2qaREji7lig-CWJe_KNHCrW1VqkZErdMo2ScNUHGtJyhKMBdpSwjqwjlTEM-Dy8vK9_5ZGIB_SP8fFhOtXNMunH8kL4tGMLjaief1TcbgmYWXnRX2tvWAuuXmBQRppL8quNEsXcJ8DOpyy1MRRxnGrvBpEUqbGpRfZdh10-FHad-WD58eJH1UQdIFt5LEvyBXUQMk5V9IQus&sig=Cg0ArKJSzAgbb-CWvf8aEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 2 B
295 B 54ms
51ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df388a0fd72a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 2
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame DA17 0
0 71ms
71ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuq77Pl8MuTfXeAExGHFDEPuo0s2stLutAitFZ4LoPgjYD4BTKFj_DhTaJCR_0Dn9KasCrtuHQa4PCmI6sdWklN0oF-yQAfYESEyGjKFem4nu4ML7_ZUYYtZ2BdYVSPoq-XBkB_98Sz_hiEGsCkJeLQZUrNQYL9IoHXE1UzNLb6EurVJh995xt-UkiGrNE5zlK4RuSPf9CWXnrftGI1ip-AP09qjUc-HWa-7T4Ql8IuVA3dvWa1_I8MyzxqJ57h6HrVSIT3sdX5ll32HjAeJHrFyCKT3gj1LeiRFq5D4_PaOwGvm-R8MiIe2sakc-y81KgHs64yuQAnCAatJ_pgEnwJajEFU_5ttJNQ6aFTSLnep9QxJ5jbbyPZFaruSizd_S2bOJ9NLB0CKiIFXG1R40NnqK8AvUW9-ASr5vU-Lb4GoaCS8iRUT2eLBejdznL54qMeKUvTrtnzwwEK&sig=Cg0ArKJSzBkAzokb3PsXEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame CA5D 0
0 74ms
72ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvPaVP5mDpEq2MhLU3-Xu4LxOZ7Z5tM08vmijcM96I-vURO-L3b2v1_Ge4-wWDYBs2gzq91mE52DtmpZ2uXlZUds6dHwYWEECLfa7hieQ6n_2B1w5l1l_gxRxAknuvmi_NjP55z2R7hDikEM6lS6dMdF5mL64e-CJ5UwIvUrkQaPZCbdpPxAWNDbbXluaALqOzp507vGfN700YgyTuUKxfb6uCvdnENJyCPdCSC6VP5ClRJB3T8HSXRVGD0NxIAYWaDAJ8IRFm6JG_Ug5JcBdzTkdQK3ExkVd_43j-TIZ7lxCwGBM04lwqSTyVR-TpCsqhNBvIXfxYtgLI29ug2I2MVIfgHnTNLDo4HMO8PDCO30THNjwyhG7NSkeLc1ZyYNef04ZmD5l28NbHGfet8GiettE2LHCrfFbyo64rOCwcF6nBdiwk1wnLrDvTY_ilj7_OkToKYwfMOMjA&sig=Cg0ArKJSzEHtybaYRma4EAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 132ms
132ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlZW52IjoiaiIsImVwaWQiOiIvMTAwOTY0MS9TcG9rZXNtYW5EZXNrdG9wX1NpZGVSYWlsXzEwMHg1MjUiLCJyZW5kZXJlZCI6IjAifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=6b28b9ba-45d6-44a7-ae2b-7588bd00d35d&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940760458&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x5049&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:20 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 1346 52 KB
21 KB 142ms
55ms Script
text/javascript 142.250.185.110
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-75318216-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: gzip
age: 900
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:04:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:04:20 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 1346 249 KB
74 KB 44ms
44ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=1fbf0a56798548ebedc105f6647460b6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

272c6cc68be58360b107c5c5fb82d07e83b184b50ff17b87de127ae3189eea92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

content-md5: YhrRdjgSVfGb0Y5VPz5nCg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "41dc842bf0ecad958485f29ac112c299"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 03:45:48 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 3ecad3989303587cd9f428cec44793bf
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=26, mss=1232, tbw=8715, tp=15, tpl=0, uplat=4, ullat=-1
x-fb-debug: PmWFe5FIAQavdCJnAXF17paX5m+Xo/QFMQIqeTKG1MFi/3urCcKfVqJ7jNmoLE/JsCzI1lDqelmhGN8iddhAVg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 75320
origin-agent-cluster: ?1

GET
H2 200 pro-v4-shims.min.js Show response
ka-p.fontawesome.com/releases/v6.6.0/js/ Frame 1346 26 KB
7 KB 62ms
34ms Fetch
application/javascript 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/js/pro-v4-shims.min.js?token=c37fafd8d9
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c37fafd8d9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 128243e3d76f97a40e2d6a650a46363351f11f9a10be7e3603471f82b0a458fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: "6695a0b8-1be0"
age: 16169110
cf-ray: 93df388bcb22028d-WAW
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7136
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 15 Jul 2024 22:20:40 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 pro.min.js Show response
ka-p.fontawesome.com/releases/v6.6.0/js/ Frame 1346 50 KB
16 KB 75ms
47ms Fetch
application/javascript 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/js/pro.min.js?token=c37fafd8d9
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c37fafd8d9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de530d97ee086c1c3765ee23249e028e2c3e47d83318e848a19812ef68966dc9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: "6695a0b9-4003"
age: 4652901
cf-ray: 93df388bdb43028d-WAW
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16387
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 15 Jul 2024 22:20:41 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 240ms
240ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk4MzYwNzAyMCIsImVidXkiOiIzNzYxNTM4ODc0IiwiZWFkdiI6IjQ2OTM2NzY1NTIiLCJlY2lkIjoiMTM4NTE1NDIxMTYyIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF8zMDB4MjUwIiwic2l6ZSI6IjMwMHgyNTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=aa7976a4-4724-4b46-b8aa-18ea4ed6ed6b&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940760471&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x5049&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:21 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 333 KB
105 KB 75ms
75ms Script
application/javascript 172.217.18.8
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Requested by

Host: cdn.sy57d8wi.com
URL: https://cdn.sy57d8wi.com/prod/spokesman/g2i.min.js?2025411

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a82452bdcca8350391d6764cab7ab55714a8a6f758696ed531dbaca05fcbc7dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Sun, 11 May 2025 05:19:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 03:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 107789
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 index.js Show response
cdn.pranmcpkx.com/ 7 KB
3 KB 286ms
83ms Script
text/javascript 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.pranmcpkx.com/index.js
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-azure-ref: 20250511T051921Z-15cb6b8966cd4j8phC1BERd85s00000008m000000000bhnv
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 75
x-ms-request-id: bf40a1a9-101e-005f-4762-be4382000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 05:19:21 GMT
x-ms-blob-type: BlockBlob
content-type: text/javascript
vary: Accept-Encoding
last-modified: Fri, 17 Jun 2022 17:08:13 GMT

GET
H2 200 SR__SPOKESMAN.json Show response
cdn.e3fbosf1tz3d.xyz/prod/data/spokesman/ 1 MB
80 KB 456ms
456ms Fetch
application/json 13.107.246.53
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/data/spokesman/SR__SPOKESMAN.json?_=1746940760902
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.53 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d570f130ada6f735a85879c5a7b01c106bdd124b80892ed66af241dbf85b86e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-committed-block-count: 1
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD8EAA8ECE5ACD
x-ms-lease-status: unlocked
x-cache: CONFIG_NOCACHE
date: Sun, 11 May 2025 05:19:21 GMT
content-type: application/json
last-modified: Fri, 09 May 2025 03:35:34 GMT
cache-control: no-cache
x-ms-request-id: fb85aab0-f01e-0035-5234-c29baa000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 80799
x-azure-ref: 20250511T051920Z-15cb6b8966ckbwtchC1BERzgsg000000081000000000auaw
x-ms-blob-type: AppendBlob

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 541ms
251ms Image
image/jpeg 16.15.179.180
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 16.15.179.180 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-amz-meta-s3b-last-modified: 20191015T134358Z
ETag: "ef2cc7f55b7ab677b023e36033e26471"
x-amz-request-id: WM1T71B2PQXWS085
Accept-Ranges: bytes
Content-Length: 631
Date: Sun, 11 May 2025 05:19:22 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Content-Type: image/jpeg
Server: AmazonS3
x-amz-id-2: Fl2iI6a7fN90XrZE8h7brPlpR8JmmpdkCFUpEaKEFLuxKF2w80fhTJlVONp9YDbdLdwXzPk3Ln88Bq+LzgAqJqbroKdG/s7nuTGKA81mUT8=

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 72ms
72ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=8884817808628495&vrg=202505060101&nw_id=1009641&nslots=5&eid=31086815%2C31090593%2C31092338%2C83321073%2C676982961&pub_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&qid=CMC4zbvVmo0DFcu1gwcdYDYs4g&iu=%2F1009641%2FSpokesmanDesktop_News_Top_300x250&e=256&ofr=1136&ret=300x250&req=300x250%7C300x600&bm=0&efh=1&stk=0&ifi=5

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 72ms
72ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=8884817808628495&vrg=202505060101&nw_id=1009641&nslots=5&eid=31086815%2C31090593%2C31092338%2C83321073%2C676982961&pub_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&qid=CMO4zbvVmo0DFcu1gwcdYDYs4g&iu=%2F1009641%2FSpokesmanDesktop_News_Footer_728x90&e=256&ofr=764&ret=728x90&req=728x90&bm=0&efh=1&stk=0&ifi=5

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 72ms
72ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=8884817808628495&vrg=202505060101&nw_id=1009641&nslots=5&eid=31086815%2C31090593%2C31092338%2C83321073%2C676982961&pub_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&qid=CMK4zbvVmo0DFcu1gwcdYDYs4g&iu=%2F1009641%2FSpokesmanDesktop_News_Middle_300x250&e=256&ofr=1136&ret=300x250&req=300x250&bm=0&efh=1&stk=0&ifi=5

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ Frame 1346 3 B
44 B 116ms
67ms XHR
application/json 216.58.212.170
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://givebutter.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
date: Sun, 11 May 2025 05:19:21 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 70ms
69ms Fetch
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

GET
H2 200 usage Show response
givebutter.com/elements/api/v1/zN1p7WO2gDzLLkGa/elements/ Frame 1346 51 B
246 B 463ms
463ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v1/zN1p7WO2gDzLLkGa/elements/usage?url=https%3A%2F%2Fgivebutter.com%2Fembed%2Fc%2Fsupport-local-journalism%3FgoalBar%3Dfalse%26gba_gb.element.id%3Dp57vbL

Requested by

Host: js.givebutter.com
URL: https://js.givebutter.com/elements/latest.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a65146e588cb9b4da0ed50d019fa26b01f86f969f642b3207fdf121a3f9a9ac

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 05:19:21 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 05:18:43 GMT
vary: Accept-Encoding, Origin
x-server: prod-app-i-0f0aea55263d14c0d
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=67276, must-revalidate, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93df388d2ab2bf3e-WAW
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 240ms
240ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk4OTUxNDQwMSIsImVidXkiOiIzNzY3NDcwMDUzIiwiZWFkdiI6IjQ3MjQxMzA0MzEiLCJlY2lkIjoiMTM4NTE2MjU5MDU5IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX01pZGRsZV8zMDB4MjUwIiwic2l6ZSI6IjMwMHgyNTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=da968a4c-b6d9-438c-abc7-1cc4159d78c4&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940760473&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x5049&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:21 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 132ms
131ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTIzOTEzMzY2NSIsImVidXkiOiIyMzEzNzk1NzgxIiwiZWFkdiI6IjQ1NzEwODI5NDAiLCJlY2lkIjoiMTM4NTA3MTUzNzM3IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX0Zvb3Rlcl83Mjh4OTAiLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=28edb695-176a-4583-a102-7d3819303e66&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940760474&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x5049&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:21 GMT
Content-Type: image/gif
Connection: keep-alive

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 58ms
58ms XHR
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14335202434165219251
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52270
x-xss-protection: 0
server: cafe

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 58ms
58ms XHR
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 13393763015339879207
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52272
x-xss-protection: 0
server: cafe

OPTIONS
H/1.1 200
OK views
prod-spokesman-proxy-connext.azurewebsites.net/api/ Frame 0
0 866ms
304ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=96982a8744fb955d49f756e12a26940d&ConfigCode=SPOKESMAN&SiteCode=SR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method: GET
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Sun, 11 May 2025 05:19:21 GMT
X-Powered-By: ASP.NET
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000

GET
H/1.1 200
OK views Show response
prod-spokesman-proxy-connext.azurewebsites.net/api/ 90 B
1 KB 214ms
214ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=96982a8744fb955d49f756e12a26940d&ConfigCode=SPOKESMAN&SiteCode=SR
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE4MTg5NDA3NjB9.17ZGk9t2Bmci6leBrJpD6t4HOyE_bCzDyzfRppZKlU4
location: System
Referer
config-code: SPOKESMAN
site-code: SR
autoqa: false
settingskey: null
access-control-allow-origin: *
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
accept: application/json
content-type: application/json
environment: prod
version: Version: 2.8.7.1
source-system: Plugin
ssid: 6654aa056f74496a8cc7c02fe9b019fe

Response headers

Access-Control-Expose-Headers: X-Server-Time,Request-Context
Content-Encoding: gzip
Expires: -1
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000, 00000000-0000-0000-0000-000000000000
Date: Sun, 11 May 2025 05:19:22 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
Cache-Control: no-cache
X-AspNet-Version: 4.0.30319
Pragma: no-cache
Request-Context: appId=cid-v1:3511aa5f-8d6c-4d6d-8b4f-ff9812ddbbcc
Access-Control-Allow-Origin: *
Content-Length: 193
X-Server-Time: 5/11/2025 5:19:22 AM
X-Powered-By: ASP.NET, ASP.NET
Server: Microsoft-IIS/10.0, Microsoft-IIS/10.0

GET
H2 200 config.js Show response
ph.givebutter.com/array/phc_cwIyuSjjEpyhbDj5a0cRqmSpB5O8CyMDb7ZBiS8MRy7/ Frame 1346 935 B
746 B 502ms
150ms Script
application/javascript 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/array/phc_cwIyuSjjEpyhbDj5a0cRqmSpB5O8CyMDb7ZBiS8MRy7/config.js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7f23af6adc7ea6c31b559530d3d85ae93198314ce5844b7d452a158a07432560

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 16
x-content-type-options: nosniff
allow: GET, HEAD, OPTIONS
referrer-policy: same-origin
access-control-allow-origin: *
content-length: 613
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/javascript
vary: Origin, Referer, Accept-Encoding
server: envoy
x-frame-options: SAMEORIGIN

POST
H2 200 / Show response
ph.givebutter.com/decide/ Frame 1346 970 B
872 B 497ms
145ms Fetch
application/json 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/decide/?v=3&ip=1&_=1746940761920&ver=1.212.1&compression=base64

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

74f314827ce393ef1a16ae0bce29826115f5d6ffe3c499c2e8dd13b59e98f268

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 9
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

GET
H2 200 utils-21.2.7.mLZ22td5.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame 1346 254 KB
61 KB 49ms
49ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/utils-21.2.7.mLZ22td5.1.0.0.js
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03ead4f04bab625255f63b23982637a01d410e17859484da407565bf957c35e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"63fd97bb5854053113365dfd9071ba8f"
age: 5356
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bsg5Z8R3NLCt962lSfF5rG4B9jFQ0K%2FZVyay52ouT1PESK5FeLX0mg6PaCx%2ByXK7NSUb71ilClj6Eu6CVweZdla6L%2FOB7MmClZGbiwpKheDrXtIr05LbofSSmRozYALoPNkh"}],"group":"cf-nel","max_age":604800}
cf-ray: 93df389229afdbd7-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=20718&min_rtt=14712&rtt_var=11437&sent=50&recv=30&lost=0&retrans=0&sent_bytes=45540&recv_bytes=3293&delivery_rate=1669989&cwnd=256&unsent_bytes=0&cid=9a90818b262bf62c&ts=1423&x=0"
date: Sun, 11 May 2025 05:19:21 GMT
content-type: text/javascript
last-modified: Thu, 17 Apr 2025 22:10:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 Donate%20-%20Heart%20Anim.json Show response
givebutter.com/storage/assets/flow/animation/ Frame 1346 110 KB
5 KB 46ms
45ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Heart%20Anim.json

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a02f78e600e8272c473819f97a46a1c070f8ceeddaf29ac5655e371375e9456a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-1b8b4"
age: 5022
x-content-type-options: nosniff
cf-ray: 93df38922e55bf3e-WAW
date: Sun, 11 May 2025 05:19:21 GMT
x-xss-protection: 1; mode=block
content-type: application/json
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0847f913637d70027

GET
H2 200 Donate%20-%20Seal.json Show response
givebutter.com/storage/assets/flow/animation/ Frame 1346 63 KB
4 KB 48ms
48ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Seal.json

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e554bc156b6e3a3d05525af219824241f504293f0300b40d8ca1385bbaf2b6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-fbf0"
age: 1985
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=OSfCKIG.nPtMiL8MCMzHDABAVLCYsCTsroa5UMELDCA-1746940761-1.0.1.1-QvFZbgzrIs9Wjq.JQI9smk8yEr91UH9D_3FUYwQbt_tPQp0.XSGYdaFkPbWTX3g87TmHVrksduk_VBjRNptHnyZ2pfRGkDjBjP6H_tEuCV7p9yFH1j8pdoNgwIonn2hep9J3XL6GMsU.SKnLS5o0eA"}],"group":"cf-csp-endpoint","max_age":86400}
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=OSfCKIG.nPtMiL8MCMzHDABAVLCYsCTsroa5UMELDCA-1746940761-1.0.1.1-QvFZbgzrIs9Wjq.JQI9smk8yEr91UH9D_3FUYwQbt_tPQp0.XSGYdaFkPbWTX3g87TmHVrksduk_VBjRNptHnyZ2pfRGkDjBjP6H_tEuCV7p9yFH1j8pdoNgwIonn2hep9J3XL6GMsU.SKnLS5o0eA; report-to cf-csp-endpoint
cf-ray: 93df38922e57bf3e-WAW
date: Sun, 11 May 2025 05:19:21 GMT
x-xss-protection: 1; mode=block
content-type: application/json
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0b9142f55306c0e03

GET
DATA 200
OK truncated
/ Frame 1346 215 B
0 Image
image/jpg

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ Frame 1346 66 B
0 Image
image/webp

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
H2 200 shield-check.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/ Frame 1346 1 KB
735 B 35ms
33ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/shield-check.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3f4864802c06951ceafa99a8fb279608ad8916696cadd3c0ec4ae6ddb1d8136

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0f7-456"
age: 908366
cf-ray: 93df38923ca3028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:21:43 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 spinner-third.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/light/ Frame 1346 459 B
420 B 45ms
44ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/light/spinner-third.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da0c53e8878f4d05a347a2edb7edcdb25e6c80dcea31f037b65c1103d0591a6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a18c-1cb"
age: 925358
cf-ray: 93df38924cce028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:24:12 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 arrow-left.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/ Frame 1346 477 B
415 B 46ms
45ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/arrow-left.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e190004f753344f8dca8e365f2f3b1ad003c2198ead3ced744018bada78952de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a1d8-1dd"
age: 14753787
cf-ray: 93df38924cd0028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:25:28 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 facebook.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame 1346 516 B
456 B 44ms
43ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/facebook.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d0bb9556119625f4c7b1882f705e38fcfb5779a9d82985f8e96cb056d5a848d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0bb-204"
age: 4482223
cf-ray: 93df38924cd2028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:43 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 x-twitter.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame 1346 404 B
391 B 49ms
48ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/x-twitter.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4c1d392a90c31f031c21d7aa51f04d0bb359027db47c5234da034da75689961

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0c7-194"
age: 18273704
cf-ray: 93df38924cd4028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:55 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 linkedin.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame 1346 672 B
520 B 52ms
51ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/linkedin.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6a55e008070dfa78b131827c914ccaadf3de9ddaf61b0938b1dc46fa3ae337c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0bd-2a0"
age: 4275907
cf-ray: 93df38924cd5028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:45 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 whatsapp.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame 1346 1 KB
710 B 51ms
51ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/whatsapp.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f08b9a120a041d6c73e69bc274d6261b474d3ec71151a8c2b940858e1026d8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0c7-46e"
age: 804498
cf-ray: 93df38924cd7028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:55 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 envelope.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/ Frame 1346 516 B
446 B 46ms
46ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/envelope.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 569014b221a3fec6083500d09ecd17f8739b6466d374cb152be16c6bc1ff05cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a53d-204"
age: 1479972
cf-ray: 93df38924cd8028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:39:57 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 copy.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/ Frame 1346 700 B
478 B 49ms
48ms Fetch
image/svg+xml 172.64.147.188
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/copy.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.147.188 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a252b9a96e5aa3f0dc99c702219819ddf46cfdfba95f2e00f4e5d32387a634d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a1e6-2bc"
age: 19140353
cf-ray: 93df38924cd9028d-WAW
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:21 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:25:42 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 Love%20Filled.svg
givebutter.com/storage/assets/flow/icons/24/ Frame 1346 659 B
454 B 49ms
49ms Image
image/svg+xml 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://givebutter.com/storage/assets/flow/icons/24/Love%20Filled.svg

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15eca989381d4b9c996b23992775d3c24307d08baacc5ce34dc3ea33f68cb7f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-293"
age: 1985
x-content-type-options: nosniff
cf-ray: 93df38923e6cbf3e-WAW
date: Sun, 11 May 2025 05:19:21 GMT
x-xss-protection: 1; mode=block
content-type: image/svg+xml
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0ec421e7f81e91214

GET
H2

200

main.js Show response
givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/ Frame 47E8
Redirect Chain

https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

8 KB
4 KB

30ms
30ms

Script
application/javascript

104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf2488b733f4b5da9265892abd5e37fa329c1020b4da7712c33fcd6e1f693f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 93df3892aeb2bf3e-WAW
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
cf-ray: 93df38924e70bf3e-WAW
access-control-allow-origin: *
content-length: 0
date: Sun, 11 May 2025 05:19:21 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 / Show response
ph.givebutter.com/e/ Frame 1346 13 B
82 B 496ms
238ms Fetch
application/json 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/e/?ip=1&_=1746940761994&ver=1.212.1&compression=gzip-js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 7
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

POST
H2 200 93df38852d4fbf3e Show response
givebutter.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.015585650015856982:1746936602:pE0lDzALsbfvLX_XUiX4WuUwHUmBj5XgpYFt-rkcMew/ Frame 47E8 0
498 B 70ms
65ms XHR
text/plain 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebutter.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.015585650015856982:1746936602:pE0lDzALsbfvLX_XUiX4WuUwHUmBj5XgpYFt-rkcMew/93df38852d4fbf3e
Requested by: Host: givebutter.com
URL: https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cf-ray: 93df38937f3dbf3e-WAW
content-length: 0
date: Sun, 11 May 2025 05:19:22 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

GET
H2 200 recorder.js Show response
ph.givebutter.com/static/ Frame 1346 110 KB
40 KB 305ms
304ms Script
text/javascript 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/static/recorder.js?v=1.212.1

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

bdb9c31c82af189d8c6c851298ea91b1be792ae1745172232a9fe6b41499025d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=60, public
cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 3
referrer-policy: same-origin
x-content-type-options: nosniff
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:22 GMT
content-type: text/javascript; charset="utf-8"
vary: Accept-Encoding, Origin
server: envoy
last-modified: Sat, 10 May 2025 23:20:19 GMT

GET
H2 200 dead-clicks-autocapture.js Show response
ph.givebutter.com/static/ Frame 1346 12 KB
5 KB 345ms
345ms Script
text/javascript 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/static/dead-clicks-autocapture.js?v=1.212.1

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

eceea9ec229684ba339474ad50f60f0c8b08706c4e2bff6a7018d0f8eab579af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=60, public
cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 6
referrer-policy: same-origin
x-content-type-options: nosniff
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:22 GMT
content-type: text/javascript; charset="utf-8"
vary: Accept-Encoding, Origin
server: envoy
last-modified: Sat, 10 May 2025 23:20:19 GMT

GET flyertown_module.js
api.circularhub.com/2871/48979fe04f6431c3/ 0
0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 104ms
56ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202505060101&st=env

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

e60dd33557688b0217cb7a3cf445daf12c7dafa288091961df70a48ced31872a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13102
date: Sun, 11 May 2025 05:19:22 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 204 rum Show response
givebutter.com/cdn-cgi/ Frame 1346 0
170 B 29ms
28ms XHR
text/plain 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 93df3897aa02bf3e-WAW
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 05:19:22 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET atrk.js
d31qbv1cthcecs.cloudfront.net/ 0
0

GET aam.js
aamcftag.aamsitecertifier.com/ 0
0

GET
H2 200 load_tags.js Show response
pymx5.com/scripts/ 9 KB
9 KB 180ms
61ms Script
application/javascript 35.227.203.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pymx5.com/scripts/load_tags.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.203.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.203.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=xz4nKQ==, md5=9rBmlHZ+cHmZ7svpU4tAOg==
etag: "f6b06694767e707999eecbe9538b403a"
age: 178
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 8946
date: Sun, 11 May 2025 05:16:24 GMT
last-modified: Fri, 15 Jul 2022 06:19:11 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwqTnLsQl8yNERt5ki7MtlEtMhG0FL6-yEq9nSJzEWPhK7AyXwTVlONhKkuiQLhroghV
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1657865951655064
content-length: 8946
server: UploadServer

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 272 KB
69 KB 83ms
41ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

d077807b2373375b2d5c8ffbfeeea0bcb152e29c21ec147aecfab6b5502e5463

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;script-src data: 'nonce-HdUmhatU' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;img-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;media-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;child-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;frame-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;manifest-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;object-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;worker-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src data: 'nonce-HdUmhatU' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=23, mss=1232, tbw=4811, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: y8BzdzdOjLxsI7aT+/LEKorI1JI+Mzsd0HE6VBwC9VUm1QHVLCzVEkTX/QMu3MPzBQB0Y9DOpth1jy21wRlpkw==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-HdUmhatU' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' data:;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 70067
x-xss-protection: 0
origin-agent-cluster: ?1

OPTIONS
H2 204 track
dc.services.visualstudio.com/v2/ Frame 0
0 440ms
102ms Preflight 20.50.88.242
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.242 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context,X-Set-Cross-Origin-Resource-Policy,Content-Encoding
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
date: Sun, 11 May 2025 05:19:23 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

POST
H2 206 track Show response
dc.services.visualstudio.com/v2/ 415 B
519 B 64ms
62ms XHR
application/json 20.50.88.242
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.242 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

d546596fae3c1ea8313f938f948c3bf85eb9a6357d145ce1c3f9a0dfb98e9f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Sdk-Context: appId

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json; charset=utf-8
server: Microsoft-HTTPAPI/2.0
x-content-type-options: nosniff

GET
H2 200 Matter-Regular.woff2
givebuttercdn.com/fonts/Matter/ Frame 1346 31 KB
32 KB 54ms
54ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-Regular.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da83fbbef0baaca05320982fb4bee293959ec222e4683ded73a621ed24dae559

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "ef5fcfdb1c5008a6d178160610eb6380"
age: 81
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cvdcB3DGyOxe7xTfe1pUGuwajsrj09bstiXlBu9j0knZz%2BQLjtkCBt83xAS%2BROTo14DiB6lcz66VTAm82Tp2QOtnsrAn34h0G16kxfuH3t%2BN0sar%2FNNQBRXHd7zsW%2BhFP%2BIW"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=23798&min_rtt=18556&rtt_var=10163&sent=563&recv=224&lost=0&retrans=0&sent_bytes=786358&recv_bytes=4070&delivery_rate=6260463&cwnd=671&unsent_bytes=0&cid=b0c0c7bae192c514&ts=1321&x=0"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:52 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93df3897d94fdcc9-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 31724
server: cloudflare

GET
H2 200 Matter-Medium.woff2
givebuttercdn.com/fonts/Matter/ Frame 1346 31 KB
32 KB 53ms
53ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-Medium.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ac3677e23d988059a7f8ce54c455ff98cd2dbf163bf8bc1b6eaac75c838228d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "b2689cd318d2ca5904e48681eacda205"
age: 756
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hp8IPHxhTtoj0fQ9CzIP%2BFG1opc%2F6QU2UKViInk7%2FQPYF68WjW%2FMBHYmzum9RWuHI7c%2BFnZ0alPAmMhaGlwb%2Bk%2FTkedmiD0CJ1TNaFhGpzGyO2KgqpFjE5MlOQhALB7g3p2%2B"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=23798&min_rtt=18556&rtt_var=10163&sent=539&recv=224&lost=0&retrans=0&sent_bytes=752490&recv_bytes=4070&delivery_rate=6260463&cwnd=671&unsent_bytes=896&cid=b0c0c7bae192c514&ts=1321&x=0"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:56 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93df3897d951dcc9-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 32112
server: cloudflare

GET
H2 200 Matter-SemiBold.woff2
givebuttercdn.com/fonts/Matter/ Frame 1346 32 KB
32 KB 52ms
52ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-SemiBold.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 856ca1ff9bf0886b1ca22ba2f59f0fe805be7dde4ed8e849a3aa2cb07d3f8cca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "efa5fe3e8fe23834c9d7c97eee4ca653"
age: 3578
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vJqhfNLHwZu7oa2pd1Kjed5sO9QDuBlTjE3HnXyG2t2lnjnnQaMZ7Cx%2FmFXMbX3Uwh4AWMkw9LXuAijnYi9P8BXjkEUGkzO6PJDobbrB2ZIKEZIh32%2F4%2F2XSzXulNlk%2BW0yP"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=23798&min_rtt=18556&rtt_var=10163&sent=515&recv=224&lost=0&retrans=0&sent_bytes=720076&recv_bytes=4070&delivery_rate=6260463&cwnd=671&unsent_bytes=0&cid=b0c0c7bae192c514&ts=1321&x=0"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:55 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93df3897d952dcc9-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 32420
server: cloudflare

GET
H2 200 Matter-SemiBoldItalic.woff2
givebuttercdn.com/fonts/Matter/ Frame 1346 33 KB
34 KB 55ms
55ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-SemiBoldItalic.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0ee583ec077fde22c36c75a03d7c8e2bc82a78d6c11519e6178770132822260

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "db8707a98531c8385f3bcc5185fd9cd1"
age: 81
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dm5PzI0iPrCP6QwjsVe8nNTVZLDPgA%2BhxwKLPxhwk7vxAeXGk1U4lsuAh1JQZwXpjHqvwXz2kdmfWyqSnRdqlpx%2FrYSBiqyBhP3RbaiV75OuLANx9DtVAE2ep5HPvp8%2B7Lbe"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=23798&min_rtt=18556&rtt_var=10163&sent=586&recv=224&lost=0&retrans=0&sent_bytes=819058&recv_bytes=4070&delivery_rate=6260463&cwnd=671&unsent_bytes=0&cid=b0c0c7bae192c514&ts=1321&x=0"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:54 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93df3897d954dcc9-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 33764
server: cloudflare

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 37ms
37ms Image
image/gif 216.58.206.78
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=93240116&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=pl-pl&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&el=10%25&_u=aCDAiUABBAAAAGACIAC~&jid=&gjid=&cid=1273096636.1746940759&tid=UA-230256-14&_gid=1415888464.1746940759&gtm=45He5571h1n715P9SH6v71896582za200&cd1=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&cd2=nation-world&cd5=2021-09-28&cd7=News&cd8=979335&cd9=story&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&npa=1&z=336692969

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tzfraa-aa-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 53148
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 14:33:34 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H2 200 favicon.09caecb42e62.ico
static.spokesman.com/sites/spokesman/img/favicons/ 15 KB
15 KB 62ms
62ms Other
image/vnd.microsoft.icon 3.161.82.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/img/favicons/favicon.09caecb42e62.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-61.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c78493afeeaa3ff629bf1327b46b6432e8e3bb1c8e05f7c890cb486fca7d5538

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31536000,public
etag: "09caecb42e620f10cd466b59cca951de"
age: 17212082
via: 1.1 5421a870e3aababe98272cc4ea364cea.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 15086
x-amz-cf-id: 7VwRq2Pb8X2mXS_Am7Xl2wan52ZP8DiWahSL3NKzFGgdW-FpCXIPBw==
date: Thu, 24 Oct 2024 00:11:21 GMT
content-type: image/vnd.microsoft.icon
last-modified: Mon, 21 Oct 2024 23:52:28 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 60ms
59ms XHR
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16120119902406170247
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52275
x-xss-protection: 0
server: cafe

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 188ms
73ms Script
text/javascript 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f1.1e100.net

Software

sffe /

Resource Hash

f2c50a16459c96e45c44e339dba2764807e8c3a174cdd8804f3fbee6a6b19198

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "1746579216026011"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6641
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-woff2

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

Content-Type: application/x-font-woff2;charset=utf-8

GET
H/1.1 200
OK 100013SR-logo-letters.png
prodmg2.blob.core.windows.net/connext/upload_images/ 14 KB
14 KB 664ms
253ms Image
image/png 20.60.62.4
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://prodmg2.blob.core.windows.net/connext/upload_images/100013SR-logo-letters.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.60.62.4 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f5a01f79f64d5b9ef018f69222a4b31357301ca04ed99ef802ad95e753c9a17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-committed-block-count: 1
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
ETag: 0x8DBBE09D315BF2A
x-ms-request-id: f89ee2e2-901e-001c-2934-c2a5de000000
Access-Control-Allow-Origin: *
Content-Length: 14041
Date: Sun, 11 May 2025 05:19:23 GMT
Content-Type: image/png
Last-Modified: Mon, 25 Sep 2023 20:56:00 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: AppendBlob

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 136ms
135ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&metered=1%7C2&metername=First%20Time%20Visitor%20-%20REG%20Wall&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=7e212afb-f5a5-4b09-a828-346a17190ab1&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940763186&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5407&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwNDEiLCJuYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwib3JkZXIiOiIxIn0sImFjdGlvbiI6eyJuYW1lIjoiRlRWX1JXIC0gQmFubmVyIC0gMXN0IEFydGljbGUiLCJ0eXBlSWQiOiIxIiwidHlwZU5hbWUiOiJiYW5uZXIiLCJvcmRlciI6IjE3In19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjEyNzMwOTY2MzYiLCJyZWZUaW1lIjoiMTc0Njk0MDc2MzE4NiJ9LHsidHlwZSI6Im1nMiIsImlkIjoiOTY5ODJhODc0NGZiOTU1ZDQ5Zjc1NmUxMmEyNjk0MGQiLCJyZWZUaW1lIjoiMTc0Njk0MDc2MzE4MCJ9XSwibWcyRGF0YSI6eyJ2ZXJzaW9uIjoiVmVyc2lvbjogMi44LjcuMSIsImVudmlyb25tZW50IjoicHJvZCIsImF1dGhTeXN0ZW0iOiJBdXRoMFVuaXZlcnNhbExvZ2luIiwiY2FtcGFpZ25OYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSIsImNhbXBhaWduSWQiOiIxMDAwNDEiLCJzdWJzY3JpcHRpb25zIjpbXSwiY29udmVyc2F0aW9uIjp7IklkIjoiMTAwMTUyIiwiQ29kZSI6IkZUVl9SVyIsIk5hbWUiOiJGaXJzdCBUaW1lIFZpc2l0b3IgLSBSRUcgV2FsbCIsIk9yZGVyIjoiMSIsIlByb3BlcnRpZXMiOnsiUGF5d2FsbExpbWl0IjoiMiIsIlZpZXdzIjoiMSIsIkRhdGUiOnsiRXhwaXJhdGlvbiI6IjIwMjUtMDUtMTJUMDU6MTk6MjMuMDkyWiIsIlN0YXJ0ZWQiOiIyMDI1LTA1LTExVDA1OjE5OjIzLjA5MloifSwiQXJ0aWNsZUxlZnQiOiIxIiwiVmlld1R5cGUiOiJDb252ZXJzYXRpb24iLCJQYXl3YWxsSW5mbyI6eyJBcnRpY2xlTGVmdCI6eyJDb252ZXJzYXRpb24iOiIxIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTGltaXQiOnsiQ29udmVyc2F0aW9uIjoiMiIsIk1ldGVyIjoidW5saW1pdGVkIn0sIk1pblZpZXciOiJDb252ZXJzYXRpb24ifX19fSwidXNlckRhdGEiOnsibWcyRGF0YSI6eyJPd25lZFN1YnNjcmlwdGlvbnMiOltdLCJBdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsIkRpZ2l0YWxBY2Nlc3MiOnsiQWNjZXNzTGV2ZWwiOnt9LCJTdWJzY3JpcHRpb24iOltdfSwiSWdtUmVnSUQiOm51bGwsIkVtYWlsIjoiIiwiTnp3TGlkIjpudWxsLCJNYXN0ZXJJZCI6bnVsbCwiRGlzcGxheU5hbWUiOiIiLCJFbWFpbFByZWZlcmVuY2VzIjpudWxsLCJBZGREYXRlIjpudWxsfX19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:23 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK cksync.php
cs.media.net/ 59 B
425 B 279ms
135ms Image
image/gif 2.19.216.27
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.216.27 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-216-27.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: bd95e8a7f7c6225934f3f14a6cdc3876566284966667fc32f88fe141e3713da6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Timing-Allow-Origin: *
Pragma: no-cache
Connection: keep-alive
Expires: Sun, 11 May 2025 05:19:23 GMT
x-mnet-hl2: E
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Content-Length: 59
Date: Sun, 11 May 2025 05:19:23 GMT
Content-Type: image/gif
Server: Apache

GET
H2 204 pixel
ap.lijit.com/ 0
193 B 328ms
126ms Image
text/plain 52.213.31.160
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.213.31.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-31-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-origin: *
date: Sun, 11 May 2025 05:19:23 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2 204 redirectuser
ssp.disqus.com/ 0
41 B 518ms
229ms Image
text/plain 34.224.66.164
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.224.66.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-66-164.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

pragma: no-cache
expires: 0
cache-control: no-store

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ 0
239 B 189ms
42ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=24298
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 402fba8a82f093def2459220061c8d31
Pragma: no-cache
Content-Type: image/gif

GET
H2

200

sync
ads.servenobid.com/
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=&gdpr=0

0
298 B

47ms
47ms

Image
image/avif

143.244.197.139
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL

https://ads.servenobid.com/sync?pid=327&uid=&gdpr=0

Protocol

Server

143.244.197.139 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
amp-access-control-allow-source-origin: *
access-control-allow-origin: *
content-length: 0
date: Sun, 11 May 2025 05:19:23 GMT
content-type: image/avif;charset=ISO-8859-1

Redirect headers

cache-control: max-age=0, private, must-revalidate
location: https://ads.servenobid.com/sync?pid=327&uid=&gdpr=0
content-length: 0
date: Sun, 11 May 2025 05:19:22 GMT
x-envoy-upstream-service-time: 0
vary: accept-encoding
server: envoy

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 261ms
131ms Image
image/gif 35.214.136.108
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=medianet&gdpr=1&gdpr_consent=&gdpr_pd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.214.136.108 Groningen, Netherlands, ASN19527 (GOOGLE-2, US),
Reverse DNS: 108.136.214.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sun, 11 May 2025 05:19:23 GMT
content-type: image/gif

GET

getuid
ib.adnxs.com/
Redirect Chain

https://ads.servenobid.com/getsync?redirect=chrome%3A%2F%2Fversion%2F
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%2...

0
0

GET
H2 200 cm
us-u.openx.net/w/1.0/ 43 B
267 B 225ms
120ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcs.media.net%2Fcksync.html%3Fcs%3D8%26type%3Dopx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 146.70.161.163
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ 43 B
363 B 229ms
105ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&gdpr=1&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 826288
expires: Sun, 11 May 2025 00:00:00 GMT
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Sun, 11 May 2025 05:19:22 GMT
content-type: image/gif
server: Kestrel

GET
H3 200 260139058256176 Show response
connect.facebook.net/signals/config/ 71 KB
14 KB 246ms
246ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/260139058256176?v=2.9.201&r=stable&domain=www.spokesman.com&hme=9ebdfdd473ffce6bfe2267012c83f73483198ffe20d84139a2066b7682f827c0&ex_m=73%2C128%2C113%2C117%2C64%2C6%2C106%2C72%2C19%2C100%2C92%2C54%2C57%2C181%2C202%2C209%2C205%2C206%2C208%2C32%2C107%2C56%2C80%2C207%2C176%2C179%2C203%2C204%2C189%2C139%2C44%2C194%2C191%2C192%2C37%2C151%2C18%2C53%2C198%2C197%2C141%2C21%2C43%2C2%2C46%2C68%2C69%2C70%2C74%2C96%2C20%2C17%2C99%2C95%2C94%2C114%2C55%2C116%2C42%2C115%2C33%2C97%2C29%2C177%2C180%2C148%2C14%2C15%2C16%2C8%2C9%2C28%2C25%2C26%2C60%2C65%2C67%2C78%2C105%2C108%2C30%2C79%2C12%2C10%2C83%2C51%2C24%2C110%2C109%2C111%2C102%2C13%2C23%2C4%2C41%2C77%2C22%2C160%2C89%2C135%2C76%2C1%2C98%2C59%2C87%2C36%2C31%2C85%2C86%2C91%2C40%2C7%2C93%2C84%2C47%2C35%2C38%2C0%2C71%2C118%2C90%2C5%2C50%2C49%2C101%2C88%2C246%2C174%2C126%2C163%2C156%2C3%2C39%2C66%2C45%2C112%2C48%2C82%2C63%2C62%2C34%2C103%2C61%2C58%2C52%2C81%2C75%2C27%2C104%2C11%2C119

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

48a815ebcf46dd19a6240a60e2f17fc5c99461989428b87471f8cc82534dd871

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;script-src data: 'nonce-PX2ljZQU' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;img-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;media-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;child-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;frame-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;manifest-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;object-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;worker-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src data: 'nonce-PX2ljZQU' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=85, mss=1232, tbw=81305, tp=75, tpl=0, uplat=205, ullat=0
pragma: public
x-fb-debug: 48dWCG0J3lFq7MYg/y69xQfLFRmkXJ/Tjix/oze/sbK8FTFzTMLwHYuppCO+P6ezaCLWVky1cQ7utekdGFzTfg==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-PX2ljZQU' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' data:;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET load_optional_tags
api.pymx5.com/v1/sites/ 0
0

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 50ms
49ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746940758631&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&cid=1273096636.1746940759&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEIAAAQ&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746940759&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&_s=4&tfd=5777
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/plain
server: Golfe2

GET
H/1.1 200
OK mc-validate.js Show response
s3.amazonaws.com/downloads.mailchimp.com/js/ 140 KB
140 KB 557ms
264ms Script
application/javascript 52.217.115.232
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.217.115.232 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b15aceb04dbf5604df5617cfe984f48479cb131c1df02825d1c24e9f35d01857

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: public,max-age=2592000
ETag: "6465dd4a8331265e6629cd069e03504c"
x-amz-request-id: CMEXMB0EAX4QAWFH
Accept-Ranges: bytes
Content-Length: 143249
Date: Sun, 11 May 2025 05:19:24 GMT
Last-Modified: Mon, 20 Aug 2018 17:42:38 GMT
Content-Type: application/javascript
Server: AmazonS3
x-amz-id-2: L42E8J8mgslBGyTFirxtue0tGoPaLPwrnd4KL5rwvSt0GSEga7MvYJwA/JdXyuhQHUwjDbO8+q8=

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/235/ Frame CE60 13 KB
5 KB 160ms
55ms Document
text/html 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f1.1e100.net

Software

sffe /

Resource Hash

59269992b50afa23926326e86714ae0e9507488992fe1975361422662ee6a2ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 845
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 05:05:18 GMT
expires: Sun, 11 May 2025 05:55:18 GMT
last-modified: Thu, 24 Apr 2025 23:13:28 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 240ms
240ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&metered=1%7C2&metername=First%20Time%20Visitor%20-%20REG%20Wall&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=feac4e7c-12a6-421d-8b9e-e744503bf7cf&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940763328&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5407&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiaW5saW5lIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwNDEiLCJuYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwib3JkZXIiOiIxIn0sImFjdGlvbiI6eyJuYW1lIjoiRlRWX1JXIC0gRVZFTklORyBFRElUSU9OIiwidHlwZUlkIjoiNCIsInR5cGVOYW1lIjoiaW5saW5lIiwib3JkZXIiOiI1In19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjEyNzMwOTY2MzYiLCJyZWZUaW1lIjoiMTc0Njk0MDc2MzMyOCJ9LHsidHlwZSI6Im1nMiIsImlkIjoiOTY5ODJhODc0NGZiOTU1ZDQ5Zjc1NmUxMmEyNjk0MGQiLCJyZWZUaW1lIjoiMTc0Njk0MDc2MzMyMiJ9XSwibWcyRGF0YSI6eyJ2ZXJzaW9uIjoiVmVyc2lvbjogMi44LjcuMSIsImVudmlyb25tZW50IjoicHJvZCIsImF1dGhTeXN0ZW0iOiJBdXRoMFVuaXZlcnNhbExvZ2luIiwiY2FtcGFpZ25OYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSIsImNhbXBhaWduSWQiOiIxMDAwNDEiLCJzdWJzY3JpcHRpb25zIjpbXSwiY29udmVyc2F0aW9uIjp7IklkIjoiMTAwMTUyIiwiQ29kZSI6IkZUVl9SVyIsIk5hbWUiOiJGaXJzdCBUaW1lIFZpc2l0b3IgLSBSRUcgV2FsbCIsIk9yZGVyIjoiMSIsIlByb3BlcnRpZXMiOnsiUGF5d2FsbExpbWl0IjoiMiIsIlZpZXdzIjoiMSIsIkRhdGUiOnsiRXhwaXJhdGlvbiI6IjIwMjUtMDUtMTJUMDU6MTk6MjMuMDkyWiIsIlN0YXJ0ZWQiOiIyMDI1LTA1LTExVDA1OjE5OjIzLjA5MloifSwiQXJ0aWNsZUxlZnQiOiIxIiwiVmlld1R5cGUiOiJDb252ZXJzYXRpb24iLCJQYXl3YWxsSW5mbyI6eyJBcnRpY2xlTGVmdCI6eyJDb252ZXJzYXRpb24iOiIxIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTGltaXQiOnsiQ29udmVyc2F0aW9uIjoiMiIsIk1ldGVyIjoidW5saW1pdGVkIn0sIk1pblZpZXciOiJDb252ZXJzYXRpb24ifX19fSwidXNlckRhdGEiOnsibWcyRGF0YSI6eyJPd25lZFN1YnNjcmlwdGlvbnMiOltdLCJBdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsIkRpZ2l0YWxBY2Nlc3MiOnsiQWNjZXNzTGV2ZWwiOnt9LCJTdWJzY3JpcHRpb24iOltdfSwiSWdtUmVnSUQiOm51bGwsIkVtYWlsIjoiIiwiTnp3TGlkIjpudWxsLCJNYXN0ZXJJZCI6bnVsbCwiRGlzcGxheU5hbWUiOiIiLCJFbWFpbFByZWZlcmVuY2VzIjpudWxsLCJBZGREYXRlIjpudWxsfX19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:23 GMT
Content-Type: image/gif
Connection: keep-alive

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
628 B 79ms
78ms Fetch
application/json 52.222.136.15
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.136.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-136-15.fra50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 051daec196e459d742ad5eef1c2a47c1339762f766d5c9d3096ebd63d4df7bd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 2cce65cc9ed94a08f98eec766e6667a8.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: P9LJZAFP5Yh99TMW3R024Nau6HLQYARYgiSTCMPK3kLGDTgmxT5U6w==
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json
x-amz-cf-pop: FRA50-P2
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
20 B 144ms
143ms Fetch 163.5.194.37
SECUREDSERVERS-EU...

General

Check archive.org

Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 163.5.194.37 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, private, must-revalidate
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:22 GMT
x-envoy-upstream-service-time: 51
vary: origin, accept-encoding, Accept-Encoding
server: envoy
access-control-allow-credentials: true

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
40 B 256ms
256ms Fetch 152.42.155.191
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 152.42.155.191 New York, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 05:19:23 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
124 B 172ms
99ms Fetch 18.159.212.21
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.159.212.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-159-212-21.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 118ms
118ms Fetch
application/json 89.149.192.192
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.192 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
741 B 159ms
158ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU57RW71
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 73c98920f05b2af9793c598970d1082b7c3a739ffea83dc981ecd550a25f93f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 90
access-control-allow-credentials: true
via: 1.1 google
expires: Sun, 11 May 2025 05:19:23 GMT
access-control-allow-origin: https://www.spokesman.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 552
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 214 B
534 B 63ms
62ms Fetch
application/json 63.215.202.146
VCLK-EU-SE Conver...

General

Check archive.org

Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.215.202.146 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE Conversant LLC, US),
Reverse DNS: ams01-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 9e6f7293cff87de3e7b04c21a2eceb6e1ed3437f0bf8940b85d4fb62320f02fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.spokesman.com
content-length: 214
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: nginx

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 83 B
471 B 106ms
105ms Fetch
application/json 52.209.86.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.209.86.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-86-237.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: dd3c89e4d3e2e8657acfae1476dccac31c9f0f0f37daeede38abcc8f9050622c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.spokesman.com
content-length: 108
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 181 B
508 B 141ms
140ms Fetch
application/json 34.1.1.166
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageReferrer=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&CanonicalUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.1.1.166 Paris, France, ASN15169 (GOOGLE, US),
Reverse DNS: 166.1.1.34.bc.googleusercontent.com
Software: fasthttp /
Resource Hash: c5015dd5691332e2f9a5e3ecd23c3e35ee9b6feea263be7d941d3c47d9e212da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-max-age: 3600
content-encoding: br
x-kong-request-id: 2a0cff69df8d9e1212f5d434dd49d30a
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS, POST
via: kong/3.6.1
x-kong-upstream-latency: 91
access-control-allow-origin: https://www.spokesman.com
x-kong-proxy-latency: 1
date: Sun, 11 May 2025 05:19:22 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: fasthttp
access-control-allow-headers: Accept-Encoding, Content-Type

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
488 B 129ms
128ms Fetch 178.250.1.38
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.26.0&cb=90784597984&lsavail=1&networkId=12005

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.38 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:23 GMT
vary: Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 140 B
707 B 104ms
104ms Fetch
application/json 185.89.210.122
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4d3e61e03d9aa56f77e00b2ae7daf5ab751184e1b907dde675dea603a5bfc891

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 146.70.161.163; 146.70.161.163; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
an-x-request-uuid: 06b85159-48c2-491d-9505-c0f494bfaaef
content-length: 140
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 11 May 2025 05:19:23 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 adreq Show response
ads.servenobid.com/ 616 B
702 B 93ms
92ms Fetch
application/json 143.244.197.139
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL

https://ads.servenobid.com/adreq?cb=6827

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

143.244.197.139 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Resource Hash

1a26a3e6f3240e6bb6f4405eb0a13fd4ab6ea71320530369dee4739d872e9341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
access-control-allow-credentials: true
amp-access-control-allow-source-origin: *
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 05:19:23 GMT
content-type: application/json
vary: accept-encoding

GET
H3 200 Mon6EX2_SLjg044S9PhfONGwAa0ds2jyqVBq5QIIZx8.js Show response
pagead2.googlesyndication.com/bg/ Frame CE60 54 KB
21 KB 85ms
38ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Mon6EX2_SLjg044S9PhfONGwAa0ds2jyqVBq5QIIZx8.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

3289fa117dbf48b8e0d38e12f4f85f38d1b001ad1db368f2a9506ae50208671f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 48547
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 15:50:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 15:50:16 GMT
last-modified: Mon, 05 May 2025 10:08:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21204
x-xss-protection: 0
server: sffe

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 230ms
181ms Fetch
image/png 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=260139058256176

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/260139058256176?v=2.9.201&r=stable&domain=www.spokesman.com&hme=9ebdfdd473ffce6bfe2267012c83f73483198ffe20d84139a2066b7682f827c0&ex_m=73%2C128%2C113%2C117%2C64%2C6%2C106%2C72%2C19%2C100%2C92%2C54%2C57%2C181%2C202%2C209%2C205%2C206%2C208%2C32%2C107%2C56%2C80%2C207%2C176%2C179%2C203%2C204%2C189%2C139%2C44%2C194%2C191%2C192%2C37%2C151%2C18%2C53%2C198%2C197%2C141%2C21%2C43%2C2%2C46%2C68%2C69%2C70%2C74%2C96%2C20%2C17%2C99%2C95%2C94%2C114%2C55%2C116%2C42%2C115%2C33%2C97%2C29%2C177%2C180%2C148%2C14%2C15%2C16%2C8%2C9%2C28%2C25%2C26%2C60%2C65%2C67%2C78%2C105%2C108%2C30%2C79%2C12%2C10%2C83%2C51%2C24%2C110%2C109%2C111%2C102%2C13%2C23%2C4%2C41%2C77%2C22%2C160%2C89%2C135%2C76%2C1%2C98%2C59%2C87%2C36%2C31%2C85%2C86%2C91%2C40%2C7%2C93%2C84%2C47%2C35%2C38%2C0%2C71%2C118%2C90%2C5%2C50%2C49%2C101%2C88%2C246%2C174%2C126%2C163%2C156%2C3%2C39%2C66%2C45%2C112%2C48%2C82%2C63%2C62%2C34%2C103%2C61%2C58%2C52%2C81%2C75%2C27%2C104%2C11%2C119

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-XgEiB1QL' blob: data: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .fb.com .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7503053446877523614&cpp=C3&cv=1022725519&st=1746940763619"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:23 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: 7RAYlfgGq5M9c65FrdGFcpRgJEbSDl3zTT8uZrUfH7Gx1yVkN75nL9dQBe1XSlO8uoioitePPYfEbse21YPALg==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7503053446877523614&cpp=C3&cv=1022725519&st=1746940763619", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-XgEiB1QL' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.fb.com *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=23, mss=1232, tbw=4814, tp=9, tpl=0, uplat=139, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 90ms
40ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=260139058256176&ev=PageView&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&rl=&if=false&ts=1746940763528&sw=1600&sh=1200&v=2.9.201&r=stable&ec=0&o=4126&fbp=fb.1.1746940763526.628218511678465553&cs_est=true&ler=empty&cdl=API_unavailable&it=1746940763264&coo=false&exp=k0&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=23, mss=1232, tbw=4589, tp=9, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
194 B 202ms
153ms Image
image/png 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=260139058256176&ev=PageView&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&rl=&if=false&ts=1746940763528&sw=1600&sh=1200&v=2.9.201&r=stable&ec=0&o=4126&fbp=fb.1.1746940763526.628218511678465553&cs_est=true&ler=empty&cdl=API_unavailable&it=1746940763264&coo=false&exp=k0&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-xza9lonP' blob: data: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .fb.com .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7503053447096407494&cpp=C3&cv=1022725519&st=1746940763616"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 05:19:23 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: /0Fxfc/KTYfYv6h/c2cvSi8WBmgPfVJW6Q7tMKCHfgnyXmQIdaKSbG2egM4fVUbaOBjKCnu9hmt7Uz8bOezvCw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7503053447096407494&cpp=C3&cv=1022725519&st=1746940763616", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-xza9lonP' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.fb.com *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=24, mss=1232, tbw=5229, tp=13, tpl=0, uplat=112, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 46 KB
19 KB 179ms
178ms Fetch
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=8884817808628495&correlator=3084107450104788&eid=31086815%2C31090593%2C31092338%2C83321073%2C676982961&output=ldjh&gdfp_req=1&vrg=202505060101&ptt=17&impl=fifs&iu_parts=1009641%2CSpokesmanDesktop_ROS_Catfish_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=6&dids=adb-dt-anchor-slot&adfs=339727705&sfv=1-0-44&fsbs=1&eri=1&sc=1&abxe=1&dt=1746940763640&lmt=1746940763&adxs=436&adys=2200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vis=1&psz=728x0&msz=728x0&fws=1028&ohw=1600&psts=AOrYGsmd3XO98rlxC0BbHErN7I8-Ohq9vbH-Lu2vYQ0acEcgBxESZ56UgkzsMmJ4HQmr4tDmeDbk14VRgA%2CAOrYGskLXWiar6QK5hpLeSKlfrRAZdTwhYVWOFIi1i4JVcXZO_i9Ogo9JvFiGg39XE8cbgwYYICEgr4jbA%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGsn4_QKiko6I01cScPJersFe4i9XBuvT7fQ1Wibydq7thFY3OhMiGiBxywyd-LTHxlqs90ArWH7fLA%2CAOrYGslV8WNlAhlHJFt2p-MMqUzpVEuvWQF67Wz8STlXRksUE0YIk1j6e_EjyEE_5n1PGfXqy0i8GbyS5cOBDYwL_TM&topics=5&tps=5&htps=5&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1746940758347&idt=573&prev_scp=pos%3Dsticky_footer%26adb_imp%3DS88.6%2C1%2Clzs_dt%26adb_bdr%3Dnone&cust_params=tags%3Debola%2520outbreak%252Csex%2520abuse%252Cworld%2520health%2520organization%252Ccongo%252Cunited%2520nations%26section%3DNews%26category%3Dnation-world%26adb_pvd%3Dt5a&adks=2659927189&frm=20&eo_id_str=ID%3D3c0569069fe680d0%3AT%3D1746940760%3ART%3D1746940760%3AS%3DAA-AfjbggjzlRfLMoXSJYTNnJJ81&gblpids=%2F1009641%2FSpokesmanDesktop_ROS_Catfish_728x90&pbbce=1&td=1&egid=59576&tan=7c446881-a755-4a47-b6bb-aba6e51e8be4&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

7c3a6bd227deff6d6ed5db8c9fd6bd0246bc7a1424b0c025e341a6cf28ba5b61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: 5239133665
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138507140014
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
content-length: 19044
x-xss-protection: 0
server: cafe

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame CE60 0
40 B 39ms
38ms Image
text/plain 142.250.185.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?oHF53w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 05:19:23 GMT
cross-origin-resource-policy: cross-origin

GET
H2 200 container.html Show response
438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/ Frame 4CCA 7 KB
0 0ms
0ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 05:19:20 GMT
expires: Sun, 11 May 2025 05:19:20 GMT
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 51ms
50ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972z8811819149za200zb71896582&_p=1746940758631&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509156~102015666~103101750~103101752~103116025~103130495~103130497~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&cid=1273096636.1746940759&ul=pl-pl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAAAAQ&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746940759&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&_s=5&tfd=6343
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/plain
server: Golfe2

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 241ms
240ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTIzOTEzMzY2NSIsImVidXkiOiIyMzEzNzk1NzgxIiwiZWFkdiI6IjQ1NzEwODI5NDAiLCJlY2lkIjoiMTM4NTA3MTQwMDE0IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9ST1NfQ2F0ZmlzaF83Mjh4OTAiLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FWarsaw&tzoff=-120&lang=pl-PL&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=83cd2530-6055-48a5-9e2a-51a518d011af&pid=1ef5abed-6c4c-4304-8bcb-3b6e58e48e14&dtm=1746940763841&qnm=_matherq&visible=1&tabid=5c12b7a0-2b7f-40d3-835f-f6ab52e9b650&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5407&tofa=1746940759&vid=1&lvidt=1746940759&duid=01eb82c4-2488-4380-9ef7-2317077c6b16&fp=1556103320&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 05:19:24 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-44/js/ Frame 4CCA 23 KB
7 KB 175ms
68ms Script
text/javascript 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-44/js/ext.js

Requested by

Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

88209e5915d9576c860ffd0d4427f4231e3712812128457065205ef71d3bf8f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 05:19:23 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6270
x-xss-protection: 0
server: sffe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame 4CCA 21 KB
8 KB 36ms
36ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 10699792191238367460
age: 54385
x-content-type-options: nosniff
expires: Sat, 24 May 2025 14:12:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 14:12:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H2 200 transparent_728x90.png
media.spokesman.com/ads/ads-img/ Frame 4CCA 1 KB
2 KB 640ms
529ms Image
image/png 18.66.122.118
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://media.spokesman.com/ads/ads-img/transparent_728x90.png
Requested by: Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-118.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6901a32f36d2f748532bc770ee035dc5583cbf3a30280a0f8a22ce2f35a93de1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

x-amz-replication-status: COMPLETED
cache-control: max-age=2592000,public
x-amz-version-id: null
etag: "c3028336a73a8863193c277c532ccf45"
via: 1.1 1b3f5dc0b3c577dc5e7394bf12aed238.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 1322
x-amz-cf-id: FNPedz927xCYT1s7CSqOQq3WO5LD2JYOO-6ckkiWeqIjcBzO22sbCQ==
date: Sun, 11 May 2025 05:19:25 GMT
content-type: image/png
last-modified: Mon, 17 Feb 2020 06:41:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
vary: accept-encoding

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4CCA 221 KB
68 KB 37ms
37ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1172
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:59:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 04:59:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 369ms
369ms Image
image/png 52.26.0.221
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2maj7f8ibUNTI1GHnci,FafRdvQOEw&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,3u1,0,1,1,1,1,1,6,6,6,6,1,0,0,0,0,6,6,6,6&b=I1,1q,1,2,:g3,4:,:s5:1n,:h1:2,8,6,,6,:r0,:D,,,5,g8,7,zu,cU::,:S7Y,:Rb,6a,g:,:Rl,bU,1S:,:Rd,Dz,x:,:Ru,QS,2Z:,:Rz,R3,2P:,:Rp,WZ,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aD,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,,,5,g8,7,zu,cU:,:H,,,0::,:CcG,:b,:Rb,6a,g:0,,1n,,0:,:b,:Rl,bU,1S:0,,3z,,0:,:b,:Rd,Dz,x:0,,2O,,0:,:b,:Ru,QS,2Z:0,,2E,,0:,:b,:Rz,R3,2P:0,,1W,,0:,:b,:Rp,WZ,2T:0,,1y,,0:,:b,:Ro,1rf,2W:0,,2l,,0:,:b,:RJ,1NL,3e:0,,23,,0:,:b,:RZ,2aj,3t:0,,2i,,0:,:b,:RX,2aD,3u:0,,1J,,0:,:b,:RY,2aK,3v:0,,27,,0:,:b,:R19,2cF,3x:0,,,,0:,:D,,,5,g8,7,zu,cU:,:H,,,0::,:qcM,1,2,:D,,,5,g8,8,zu,72::,:Qg5,1,2,5,n,o,p,q,p,q,:D,,,5,eG,5,y2,72::&b=GcM,2,:K9,:ka,b,c,d,e:f,:kg:h,:ki:j,:kk::,:L1:&b=Kl,:km:&bi=Umk066REhsSa5,adb-dt-anchor-slot,1009641,SpokesmanDesktop_ROS_Catfish_728x90,728x90,0.05,0x0,728x0,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,pos,sticky_footer,4ZlNuc,2wArYN,2rbzQlg,5IyRZT&bt=uKRzpqV&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.maj7f7cl.2T157.3T43l&g=3T4z9&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.48o.1.0&adbj=ka19maj7f8efj9u8&mp=0.3&adb_cm=t5a&txx=Txx4&rnd=1746940763946
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.26.0.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-26-0-221.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 2 B
298 B 56ms
55ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93df389f4f5e2a51-WAW
access-control-allow-origin: https://www.spokesman.com
content-length: 2
date: Sun, 11 May 2025 05:19:24 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4CCA 0
0 70ms
70ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssWHz3BTRd2WrtvhQxRkDzmuSaRvTGTdTOG8A7g8FIL8L95lUy1nSbW8mSGOZiKG9Hr_SLNWM4lexWWu-BiMTTQJgHziANiDBN5QGVmim5pPwCI_9r2gBSaLBr5dMgfz7T5x3VwJS5Zr6RWz_62LvCKn8pvX8gIoY9nJDDoL8ypt3LtyhBYJV3C6xqLfIPhTArf6k4EgAlKpKJeeTTRbGLY_UmUzUmDUBOktD-GswLEoPgvzkFuAvvQVOJiHPS70aAGOx2tMStyMhevuzvG9THhfgVFjm24IRq-C8x5y-_bHA0IMuH-wd0bNbGBANXTszRqqQ07zv0ApPeLZOgp5QUeV9InWYTbdKuanog_H2uA7p4nUX8s2E6nS_WBrta99PApbBWKcjV3XAXkgFsg4CULUGuWUK6wQqCq6g1oiQKtsfzLOIcYB1tBX4yT7BPFeMP48ZnPU3Xr&sig=Cg0ArKJSzAMtoSa902ZBEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 srDigital_Attention_v1_Feb2025_728x90.html Show response
media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/ Frame 8E61 3 KB
2 KB 638ms
537ms Document
text/html 18.66.122.115
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.html
Requested by: Host: 438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
URL: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-115.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bcdfa6c6326a2b625cbc3665cc4e01ca4fe89ad31d377ab9ee5d92e63986a716

Request headers

Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: max-age=2592000,public
content-encoding: gzip
content-type: text/html
date: Sun, 11 May 2025 05:19:25 GMT
etag: W/"800462968c3a907c10d915b0308e8a1c"
last-modified: Tue, 04 Feb 2025 22:23:24 GMT
server: AmazonS3
vary: accept-encoding
via: 1.1 da6955a1993e1118f32bcb48c6630c20.cloudfront.net (CloudFront)
x-amz-cf-id: x9u0IPMyN2LKFEysc8u95l7KSK1BwgtC13uilAeFcK2MI17GS9S_FQ==
x-amz-cf-pop: FRA60-P2
x-amz-replication-status: COMPLETED
x-amz-server-side-encryption: AES256
x-amz-version-id: 8MfAF3NcOwSWQee6sx8.DZx_v3lCIFKL
x-cache: RefreshHit from cloudfront

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4CCA 0
0 92ms
91ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4CCA 0
0 92ms
92ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4CCA 0
0 84ms
84ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 4CCA 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c64fe067563ccdd39e1b62884b03c4191847f2649ff96b4857a868ca4d043038

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 72ms
72ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=8884817808628495&vrg=202505060101&nw_id=1009641&nslots=6&eid=31086815%2C31090593%2C31092338%2C83321073%2C676982961&pub_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&qid=COeypr3Vmo0DFYXyuwgdpUIRNg&iu=%2F1009641%2FSpokesmanDesktop_ROS_Catfish_728x90&e=0&ret=728x90&req=728x90&bm=0&efh=1&stk=1&ifi=6

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4CCA 0
0 75ms
75ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsv86JC85W45H3jdfPfWeaLpaZOEYeTOrBk235Aj_OTJhT7j-DQENmTBdbdPzwfXZKyxm3xy322z6Zs0syXeszkUFFUkZD1oeYMd5bjwk5ZLVOBhvhI2c96msOLGmALt3E3S1uMj2QYxHbmq_SP96zx8npFtSxhA2fEfjODiPXxLy5xx6CbA91fW_b8yz4IVWBuHdWAS_rL4YVnKzUBidA-NsfH6p4VP6FN6fklp--XFDbl1e9Ry4DlXMehEl8qIpDhyTOPKA4VHXimmm8rimftrWhhB4pz7z3nSbzzVQqGsOXdcNHxbN-4JvFWcI9mDTyfJgnlAa_EzHCPTBaskG2BoOfvSSCtesRwkPQvm78jLFRkGepLC8r_zkbTYktOr26B-bdzFW2OnQB78LlW6blp4SOAY6_rDSSKhOpM4ewDJTFHce8WeDs6bdVRRmXe109p82kPN1wERqmY&sig=Cg0ArKJSzPkGpWv9CK3yEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 05:19:24 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 59ms
59ms XHR
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6084503635867951353
x-content-type-options: nosniff
expires: Sun, 11 May 2025 05:19:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 05:19:24 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52278
x-xss-protection: 0
server: cafe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 70ms
69ms Fetch
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 8E61 236 KB
63 KB 215ms
72ms Script
text/javascript 2.22.242.114
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: media.spokesman.com
URL: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.22.242.114 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a2-22-242-114.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://media.spokesman.com/

Response headers

x-n: S
cache-control: max-age=900
content-encoding: gzip
expires: Sun, 11 May 2025 05:34:24 GMT
accept-ranges: bytes
date: Sun, 11 May 2025 05:19:24 GMT
content-type: text/javascript
vary: Accept-Encoding
server: Apache

GET
H2 200 srDigital_Attention_v1_Feb2025_728x90.js Show response
media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/ Frame 8E61 27 KB
6 KB 501ms
500ms Script
application/javascript 18.66.122.115
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.js
Requested by: Host: media.spokesman.com
URL: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-115.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 02cd21552b450393df9ecd425f36b6297b8bc13120a8807d5c417e50e8ea6d10

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/srDigital_Attention_v1_Feb2025_728x90.html

Response headers

vary: accept-encoding
x-amz-replication-status: COMPLETED
cache-control: max-age=2592000,public
content-encoding: gzip
x-amz-version-id: KwHl0H7pEySIoyfWWdXpPo4Xmw1Rol9K
etag: W/"4b41fb8d01f214b1a048b6714c0a217c"
via: 1.1 da6955a1993e1118f32bcb48c6630c20.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: Y2rcJlmAOMOsUVXCQxTrBAryVwf8XuIcdkIwFGNGgQTE-DcBzVRPpg==
date: Sun, 11 May 2025 05:19:26 GMT
content-type: application/javascript
last-modified: Tue, 04 Feb 2025 22:23:24 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256

POST
H2 200 / Show response
ph.givebutter.com/e/ Frame 1346 13 B
103 B 287ms
285ms Fetch
application/json 54.90.36.212
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/e/?ip=1&_=1746940764919&ver=1.212.1&compression=gzip-js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.90.36.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-90-36-212.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 7
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 05:19:25 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

GET srDigital_Attention_v1_Feb2025_728x90_atlas_1.png
media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/images/ Frame 8E61 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4CCA 42 B
65 B 74ms
73ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssNpTVI8L_vgAyk6ximKD6XvocT7HEqm11xrwoGMj7165neftUp-3UU-4ToWmsl29Nx9x2cXiI_FJ7TElDzCCMQCe7Ml4l0V0sf7Fi6boFHghdezICYcBuEd73m8AzEIyJCKeUoIHutQc3U0JRlDL4wfhBY1msdZEoJtQy3c6G5784bCOi2AQ&sig=Cg0ArKJSzITrgXXgA934EAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&tm=1453.6999988555908&tu=453.6999988555908&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250507&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2659927189&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4287356400&rst=1746940763828&rpt=665&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 11 May 2025 05:19:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame B738 200 B
1 KB 40ms
39ms Document
text/html 13.32.99.78
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.78 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-78.fra60.r.cloudfront.net

Software

Cloudfront /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://givebutter.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1954
alt-svc: h3=":443"; ma=86400
cache-control: max-age=31536000
content-length: 200
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 04:46:51 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Fri, 09 May 2025 20:07:01 GMT
origin-agent-cluster: ?1
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-cf-id: jw2gZp2CWKsQzhUKJ6odyd9-Z68EMv5PiP0Q3SE5jD9AekP4C8UA8Q==
x-amz-cf-pop: FRA60-P3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B738 526 B
894 B 41ms
41ms Script
text/javascript 13.32.99.78
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

QUIC, , AES_128_GCM

Server

13.32.99.78 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-78.fra60.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Response headers

etag: "d96c709017743c0759cf3853d1806ba5"
age: 357
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: yKxF7h9AC5R0tl9DquVBQCRedL7XexWg66EpmxuWmlBCd3bxFgkgyw==
date: Sun, 11 May 2025 05:13:30 GMT
content-type: text/javascript; charset=utf-8
last-modified: Fri, 09 May 2025 20:06:59 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=31536000
timing-allow-origin: *
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 526
x-amz-cf-pop: FRA60-P3
server: Cloudfront

GET
H2 200 inner.html Show response
m.stripe.network/ Frame B58E 930 B
2 KB 226ms
76ms Document
text/html 18.173.205.12

General

Check archive.org

Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.205.12 -, , ASN (),

Reverse DNS

Software

Cloudfront /

Resource Hash

34a85e78b5402c253c2bc4cf64426c2b6b18601602e8a9a71568139fb3ee6599

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 177
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 05:16:30 GMT
etag: "f5eaddb4dfc7e121aba2112e1ca3ef2d"
last-modified: Fri, 09 May 2025 17:26:51 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 506bffda4b1949c4425629ce0bdce052.cloudfront.net (CloudFront)
x-amz-cf-id: rVrEsObAegyfuMCVgge_tkuzXH9AJhkzFPlTc0oESKlv6o-5UspI_w==
x-amz-cf-pop: FRA56-P12
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/60/12/intl/pl_ALL/ Frame 1346 119 KB
35 KB 53ms
53ms Script
text/javascript 216.58.212.170
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/pl_ALL/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f10.1e100.net

Software

sffe /

Resource Hash

75db7e0c2d51f8dc4f9841c3d8c6d9716df0964f0e51d54e8b6d428c2c0baf00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
age: 45743
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 16:37:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 16:37:03 GMT
last-modified: Wed, 07 May 2025 17:43:41 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 35966
x-xss-protection: 0
server: sffe

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/60/12/intl/pl_ALL/ Frame 1346 319 KB
73 KB 57ms
57ms Script
text/javascript 216.58.212.170
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/pl_ALL/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f10.1e100.net

Software

sffe /

Resource Hash

d3c1ab5f3efd97f3f199b2e3e5400c80bfb83324494c408dfc8d9a695fcd4712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
age: 49979
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 15:26:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 15:26:27 GMT
last-modified: Wed, 07 May 2025 17:43:41 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 74340
x-xss-protection: 0
server: sffe

GET
H2 200 out-4.5.44.js Show response
m.stripe.network/ Frame B58E 87 KB
14 KB 105ms
104ms Script
text/javascript 18.173.205.12

General

Check archive.org

Download Go to

Full URL

https://m.stripe.network/out-4.5.44.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.205.12 -, , ASN (),

Reverse DNS

Software

Cloudfront /

Resource Hash

bd6e71e0a8f18b3dd4bbeb6fd673015fec896bd92e17c11f3dc8fe96a06de1f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://m.stripe.network/inner.html

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=300, public
content-encoding: br
etag: W/"fd35981a337052cd3ccd82dc674ff76d"
age: 126
x-content-type-options: nosniff
via: 1.1 506bffda4b1949c4425629ce0bdce052.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 6pxsEsnrPN46VMVPFUJ-qxPO6m3-C5ST08sGTf5HUFUPvBlFAiC_Mw==
date: Sun, 11 May 2025 05:17:21 GMT
content-type: text/javascript; charset=utf-8
last-modified: Fri, 09 May 2025 17:26:51 GMT
server: Cloudfront
x-amz-cf-pop: FRA56-P12
vary: Accept-Encoding, Origin

POST 6
m.stripe.com/ Frame B58E 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.circularhub.com
URL: https://api.circularhub.com/2871/48979fe04f6431c3/flyertown_module.js

Domain: d31qbv1cthcecs.cloudfront.net
URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js

Domain: aamcftag.aamsitecertifier.com
URL: https://aamcftag.aamsitecertifier.com/aam.js

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%25253A%25252F%25252Fversion%25252F

Domain: api.pymx5.com
URL: https://api.pymx5.com/v1/sites/load_optional_tags

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=235&t=2&li=gpt_m202505060101&jk=8884817808628495&bg=!7u2l7aLNAAbgx1aQwMc7ADQBe5WfONxkcwQAXnniTxM3FO2yYkYs9GMuVJdtn59zaKD3CJEkX3WsCO8rDF_8iUrI9M1yAgAAADNSAAAAA2gBB34ANiUOutMFtmcXG7EwesdLvp59fuXDiLZabIUIOBNjY5qqtSrvE-cNbnXDiOxVrcA2JLLKis71u5kCUxfa7rdGMNKcChho8nuNDwAvuzi0J4gJ7MpoqKifSpla5D7wqgcy0B6P-AoixqGrcD3YZx_LAEcU5WscvFxV50drL-YSsOUfL4theySNJLr25oBISJfRDTWWIk6VP-2Zlv4uzF01vxmN6AfGdyBA9DJJqvZqb_gqyVm3wo7s7LowEWL5RptMEiqJYLuTOZ7nTJrpWlQbgztelbYltK_WhDkwneKqlo1qQPUAZOc59DMnNMVv8-SMegZ7JlLjy5ruJYDWkGnlXzHBkjxi3ojs9YlBSlrkN55g8iy7PkwVofTfQU2PZgFOrJBrjOooFSOLSsRz9eizE84RwzhXpocURL17vy9m9HVBikGm3_A4coUbEY-x9_pzwYuHaw3Xjs0A6sy-hoR38X3e9uZZp6NqpJyyHIKWIeaCyBoTB6ksp4xpkbGqXexrlnepVu8cpNn4OVg06pNSbTmXiigb1PSK8KDO0HYL_gEAmMpFB3mk_iGZWaSoQIFNXwiTd0y8g5_a3wGJsPcET8Imdw-3xL33Xdj2kzPOBOcf4jrAWPiCl_LPfdDrGtcsdEVBqueRh_I3cmYnIIQvUy7_RNVQEdmbl4eqBNJ9iHndXIOJ83jZiBiR6dfvT_QLrkvxVGhR--Yqo4-q-xmg3o7soxZ9GUlpsJoqZLTX7q-nJ2uSDuCYb71lHXuGx_6YH-eVix7Cgpe4fF9YZRuoBdfqbRRxl8BkMGuOPzGZNMYbzfU1k3Qn2MtAmu71HX6clPYS2In7F9-InF1xkSzTgEMNv5HMvyDwu2KtMPw

Domain: media.spokesman.com
URL: https://media.spokesman.com/ads/spokesman-digital/feb2025/house/v3/728x90/images/srDigital_Attention_v1_Feb2025_728x90_atlas_1.png

Domain: m.stripe.com
URL: https://m.stripe.com/6

Verdicts & Comments Add Verdict or Comment

145 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.criteo.com/openrtb_2_5/pbjs/auction	1970-01-21 14:37:16	Name: cto_bundle Value: RKSK_l80dGN4dFUxVnBNanh5dkJKbkVyb3ZmdjVaZmMyaXNPMk5KMDMwd0FhUnl0YXRuZ0puQTU2ZFpLM2xZdkJUNFVISVRwbVRNN0ZhVXBOSnJyaXhqUG1aUXdvOXZMSHgwb3FhWEd6JTJGV3l2d2RNJTNE
.spokesman.com/	1970-01-21 09:34:56	Name: ___nrbic Value: %7B%22isNewUser%22%3Atrue%2C%22previousVisit%22%3A1746940758%2C%22lastBeat%22%3A1746940758%2C%22currentVisitStarted%22%3A1746940758%2C%22sessionId%22%3A%22db7fe643-ef9b-43d4-b4f3-ff014009d783%22%2C%22sessionVars%22%3A%5B%5D%2C%22visitedInThisSession%22%3Atrue%2C%22pagesViewed%22%3A1%2C%22landingPage%22%3A%22https%3A//www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/%22%2C%22referrer%22%3A%22%22%2C%22lpti%22%3A%222021-09-28T10%3A08%3A00%22%7D
.spokesman.com/	1970-01-21 09:34:56	Name: ___nrbi Value: %7B%22firstVisit%22%3A1746940758%2C%22userId%22%3A%227c82fb35-43ee-455a-820c-ff3cc96469d6%22%2C%22userVars%22%3A%5B%5D%2C%22futurePreviousVisit%22%3A1746940758%2C%22timesVisited%22%3A1%7D
.spokesman.com/	1970-01-21 09:34:56	Name: compass_uid Value: 7c82fb35-43ee-455a-820c-ff3cc96469d6
.givebutter.com/	1970-01-21 05:15:42	Name: __cf_bm Value: vOwGd0MIrpIBernvozHdwXOmuIHst8CMYZ8sVAMYKkE-1746940758-1.0.1.1-oZYwo9FwF8WVxyBF0WOELxaqN0JuH9j2yot2SDVjC0LjdXwgj__lQS0ESAKCIa9gCEwJpk4wtxgzXzBWxsZX4kGrnevVm6y1uG85GEUjZ9E
www.spokesman.com/	1970-01-21 14:01:16	Name: flipp-uid Value: 16113c39-2548-4532-a67e-3a9e5b95a653
events.newsroom.bi/	1970-01-21 09:34:52	Name: 6814_u Value: 7c82fb35-43ee-455a-820c-ff3cc96469d6
events.newsroom.bi/	1970-01-21 05:58:52	Name: 6814_lv Value: null
events.newsroom.bi/	1970-01-21 05:58:52	Name: 6814_ut Value: 0
.spokesman.com/	1970-01-21 14:51:40	Name: _ga Value: GA1.2.1273096636.1746940759
.spokesman.com/	1970-01-21 05:17:07	Name: _gid Value: GA1.2.1415888464.1746940759
.spokesman.com/	1970-01-21 05:15:40	Name: _dc_gtm_UA-230256-14 Value: 1
.spokesman.com/	1970-01-21 05:15:40	Name: _gat_gtag_UA_230256_14 Value: 1
.spokesman.com/	1970-01-21 05:15:42	Name: _sp_ses.53c5 Value: *
.p.flipp.com/	1970-01-21 14:51:40	Name: gid Value: "AzQiWQAArvBN9HvVAO7szA=="
prebid.media.net/	1970-01-21 09:34:52	Name: receive-cookie-deprecation Value: 1
www.spokesman.com/	1970-01-21 14:01:16	Name: ai_user Value: T9Ipp\|2025-05-11T05:19:20.270Z
.spokesman.com/	1970-01-21 09:34:52	Name: __eoi Value: ID=3c0569069fe680d0:T=1746940760:RT=1746940760:S=AA-AfjbggjzlRfLMoXSJYTNnJJ81
.givebuttercdn.com/	1970-01-21 05:15:42	Name: __cf_bm Value: PHsSvqKaE.scXZgVUKvosKcASyJuY971qV6FDLrySSQ-1746940760-1.0.1.1-m2BvVSuwjOz8WSBkiUj6vJYjhuugxnWmVSMC846DLe4NbPq1fi5wod_8KVJ_10vAJsnh0Q4MaGWU7DitUVQ8rGBNYltCQgg5rFWfvVZqMug
events.newsroom.bi/	1969-12-31 23:59:59	Name: 6814_s Value: db7fe643-ef9b-43d4-b4f3-ff014009d783
.spokesman.com/	1970-01-21 14:01:16	Name: anonDeviceId Value: 96982a8744fb955d49f756e12a26940d
.spokesman.com/	1970-01-21 14:01:16	Name: nxt_last_visit Value: 1746940760901
www.spokesman.com/	1970-01-21 05:15:42	Name: ai_session Value: sBXe+\|1746940761566.3\|1746940761566.3
.givebutter.com/	1970-01-21 14:01:16	Name: cf_clearance Value: iJIJERfMHP3uD3SYA.EBhUtVnCeZC7Ksib2Y3saI8K0-1746940762-1.2.1.1-2qNjJTPWocmyuU9bonme..6M2R0GBknjEf0Cgav2gURyAZwG77pGe3CbOHfGeXvo1.otboC2gc4MgowEVUFOi4IiV_6.RmnHYchdQKIuSM17gYG6qEEEoHR.PkbQHPaVLOCpYMrMtO3zOq0oOwLCaaMLX3rBEHjErbquPUXSDNmrp80dDgiwxvzJZSPk5ENf908FZJyvTcmN1muiIw2Xf_VufEjS_TPhCH0OZkhJs0PGmF0XISwmFSnln0D.VfRphpSA4UDrjlWHsbdSMle_SqCgUdgn9.XiwC_vbeq8dcccDxAZUjJuyHGmzxtGqol4XWNCS6YlvnyEYgWmn.a_epnVjuAAwncgUc4PcPCtriQ
.spokesman.com/	1970-01-21 14:01:16	Name: nxt_upd_ac_SR_SPOKESMAN_PROD Value: 1
.spokesman.com/	1970-01-21 14:01:16	Name: nxt_SR_SPOKESMAN_PROD Value: {%222%22:{%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22FTV_RW%22%2C%22FTV_RW%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1746940763092%2C%22far%22:0%2C%22frp%22:[]}}}
.spokesman.com/	1970-01-21 07:25:16	Name: _fbp Value: fb.1.1746940763526.628218511678465553
.spokesman.com/	1970-01-21 14:51:40	Name: _ga_G3BY0LGVDL Value: GS2.1.s1746940759$o1$g1$t1746940763$j56$l0$h0
.spokesman.com/	1970-01-21 14:51:40	Name: _sp_id.53c5 Value: 01eb82c4-2488-4380-9ef7-2317077c6b16.1746940759.1.1746940764.1746940759

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js(Line 10) Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network	error	URL: https://idsync.rlcdn.com/712559.gif?partner_uid=16113c39-2548-4532-a67e-3a9e5b95a653 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://api.circularhub.com/2871/48979fe04f6431c3/flyertown_module.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://aamcftag.aamsitecertifier.com/aam.js Message: Failed to load resource: net::ERR_SSL_UNRECOGNIZED_NAME_ALERT
network	error	URL: https://api.pymx5.com/v1/sites/load_optional_tags Message: Failed to load resource: net::ERR_CONNECTION_RESET
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0E01C00AC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

438b2c97c777092bda8fc10369d55311.safeframe.googlesyndication.com
aamcftag.aamsitecertifier.com
ads.servenobid.com
adspsp.com
ap.lijit.com
api-mg2.db-ip.com
api.circularhub.com
api.pymx5.com
az416426.vo.msecnd.net
btlr.sharethrough.com
cdn-gateflipp.flippback.com
cdn.a3kvau184uea.com
cdn.e3fbosf1tz3d.xyz
cdn.plaid.com
cdn.pranmcpkx.com
cdn.q0losid.com
cdn.sy57d8wi.com
cdn.wgchrrammzv.com
challenges.cloudflare.com
code.createjs.com
connect.facebook.net
cs.media.net
d31qbv1cthcecs.cloudfront.net
dc.services.visualstudio.com
dis.criteo.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
events.newsroom.bi
exchange.kueezrtb.com
fundingchoicesmessages.google.com
givebutter.com
givebuttercdn.com
grid-bidder.criteo.com
hb-api.omnitagjs.com
hb.minutemedia-prebid.com
hb.yellowblue.io
ib.adnxs.com
idsync.rlcdn.com
js.braintreegateway.com
js.givebutter.com
js.matheranalytics.com
js.stripe.com
ka-p.fontawesome.com
kit.fontawesome.com
m.stripe.com
m.stripe.network
maps.googleapis.com
media.spokesman.com
p.flipp.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
ph.givebutter.com
pixel.rubiconproject.com
prebid.a-mo.net
prebid.media.net
prg.smartadserver.com
prod-spokesman-proxy-connext.azurewebsites.net
prod.adspsp.com
prodmg2.blob.core.windows.net
pymx5.com
region1.analytics.google.com
s3.amazonaws.com
sdk.mrf.io
securepubads.g.doubleclick.net
ssp.disqus.com
static.cloudflareinsights.com
static.spokesman.com
stats.g.doubleclick.net
thumb.spokesman.com
tpc.googlesyndication.com
us-u.openx.net
web.hb.ad.cpe.dotomi.com
widgets.givebutter.com
www.facebook.com
www.google-analytics.com
www.google.pl
www.googletagmanager.com
www.i.matheranalytics.com
www.spokesman.com
x.bidswitch.net
aamcftag.aamsitecertifier.com
api.circularhub.com
api.pymx5.com
d31qbv1cthcecs.cloudfront.net
ep1.adtrafficquality.google
ib.adnxs.com
m.stripe.com
media.spokesman.com
104.16.79.73
104.18.24.90
104.18.94.41
104.19.220.32
104.20.36.218
104.20.37.218
104.26.2.180
104.26.5.15
107.178.250.234
108.177.15.155
13.107.246.53
13.107.246.64
13.32.99.78
13.33.187.112
13.35.58.11
13.35.58.95
13.85.16.224
142.250.184.193
142.250.185.110
142.250.185.226
142.250.185.97
142.250.185.98
142.250.186.129
142.250.186.131
142.250.186.98
143.244.197.139
151.101.2.133
152.42.155.191
157.240.0.6
157.240.251.35
16.15.179.180
163.5.194.37
172.217.18.14
172.217.18.8
172.64.147.188
178.250.1.38
178.250.1.9
18.159.212.21
18.173.205.12
18.245.86.10
18.66.122.115
18.66.122.118
185.89.210.122
2.19.216.27
2.22.242.114
20.50.88.242
20.60.62.4
216.239.32.36
216.58.206.78
216.58.212.170
3.161.82.61
34.1.1.166
34.120.63.153
34.198.218.70
34.224.66.164
34.98.64.218
35.214.136.108
35.227.203.93
35.244.174.68
44.218.68.176
52.209.86.237
52.213.31.160
52.217.115.232
52.222.136.15
52.222.236.129
52.26.0.221
54.90.36.212
63.215.202.146
69.173.144.165
89.149.192.192
00acb35a95afb24dd8bf9fd2dd8109bc2de409077a77846386391c4c2d0d1f1c
00c99b5a5a184a82850f69d54e2b4fc68135b6fd3da3c9797033c50570a72c18
029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a
02a30ea6b407de1b91903c7b846cd49cf8bd7fde84369dac046578a845b2481a
02cd21552b450393df9ecd425f36b6297b8bc13120a8807d5c417e50e8ea6d10
0399699a7279e9e5c8b1fef1962029bdd83c8883e9ef314e5585cded68304f5d
03ead4f04bab625255f63b23982637a01d410e17859484da407565bf957c35e4
0497cc0bcf324fbc1eb739bd2f79f0afe356bbad0e1732622c5792775d2eef91
051daec196e459d742ad5eef1c2a47c1339762f766d5c9d3096ebd63d4df7bd7
05f8e18ff6cfd0f6301a221842c6b541261607caa65edbb1d93c69d3f5001e2d
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
0cb1bf32539483f685b02b014d2a44009828e0345cfad31af0f082df7bac97a6
103336c754fde9c2c7fc565bc5385b94409c0d5480cd8564c25f18f6cced5a85
10e7d0dca9977b835dfcf9775698cef2309ee50a823f797a74ebe5c9d95ae5a5
11b98a9c0c860d3d72181a89a029a7ce9ea9a9074aa8f6d5dc37841e082f10ee
128243e3d76f97a40e2d6a650a46363351f11f9a10be7e3603471f82b0a458fa
13661e9e77aafe5724ae07f269af0d07ba03f56dfd7b00f467558759df836c96
1395f9dfbc141826fbc67b90204496b4cc97d9ac6171ff4c88ace15abc649850
15b386505eda43b9e2cec7f2a8864e16d81c419883a9b71967c5267e0006a23a
15eca989381d4b9c996b23992775d3c24307d08baacc5ce34dc3ea33f68cb7f7
15ff29496ac40d398a774a309adfc1777340b666b3d00474a368da343bf266d7
16ed4d18a5b47da1ff058ebc498f4afe543c488e01f142f2afb60f334fdfa9db
1768c23832bcb03d3fcdd3f6edf07a71f0c5c7b6323e50a4fa2e9276cd30800e
19abc0bf04517d277a8159f6df85d62bdaae81c51e9c9b4f4392202ddee40b05
1a26a3e6f3240e6bb6f4405eb0a13fd4ab6ea71320530369dee4739d872e9341
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1dfae417465bc4ba3e518e6adee43d27c0aeee39eaf536d68ca301b0cafb1145
1f08b9a120a041d6c73e69bc274d6261b474d3ec71151a8c2b940858e1026d8f
1fd8651da4452b29620b594e1f0e28509bdbf93079e85a95d54297740603d7ad
21efb02b66643901471d3409a3a318a85a0623e6298bf467b10772a281a181db
23dd2a9d31ac5ee27bc8d601812cb813b3f986f704c73cd74242691221021ecd
259f0c66228bbf666be1d43e7ba2df1cdbe4c5d5ec11f92b7c7309492e897e98
2714ccb688a226df01ec80ee38d396582b9a9d06a82cf54c65b3d0d29ac58619
272c6cc68be58360b107c5c5fb82d07e83b184b50ff17b87de127ae3189eea92
297bd0260f572990cfa4545594c1510192ae33b78ec211ebb84aa74d79ceb1a1
2cef469e089a57eed9dc5bc2a1d85e710e6dc78a6b827289bf38867078509218
2d171ef8826ff1270d31583bc6e638435b6b382a31e67ed6a2da53c10eeb1004
2d9f8cd6984fed9b5196dc9b4d2da9ac37226be6c94a39ee2f56073f73e22093
2f219207f3d6a30452c637cb2c1e1d2ffaf4852a0d55acf36ade1a47cf729640
2f4e461046f3bb7885829e48f8dab784f2b1e65c8a115742488762af28829d41
3289fa117dbf48b8e0d38e12f4f85f38d1b001ad1db368f2a9506ae50208671f
34a85e78b5402c253c2bc4cf64426c2b6b18601602e8a9a71568139fb3ee6599
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
368af165cf521e89c6e268f933db3b3f6f78dd648ce93112bdc07846faebcfdd
3b0a863df8ff7675e7f475e64dcd92f6cb648e7c6953c2cb51aaea986a25d9ab
3ce60d9d35f57c9a4f26168b12a9322caa9d9cd834473abd20454b39802bc421
3dda5d66b2884ca37dda8bbfe1e77a3d088f181d068aa17cdf0d2f21ca9765cf
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
459ad44dd647d3544551e4ab7848cbfdd29799adac87a8a7e9767acb66e8fa79
478eb7d52d6939db24f8e7bec9738452f26be903f33d085272fe96aded025c9c
48a815ebcf46dd19a6240a60e2f17fc5c99461989428b87471f8cc82534dd871
492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2
49c2c0bb2cbd3a9ff860dc035f4cbfcd801cc89e7c33fc04f56e20dac73b59ba
4cc88e309177d92c0dbc370458cf4739082e37e2b988c50a8002a1433c052593
4d3e61e03d9aa56f77e00b2ae7daf5ab751184e1b907dde675dea603a5bfc891
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e554bc156b6e3a3d05525af219824241f504293f0300b40d8ca1385bbaf2b6b
4fda72116dacabbed70d130340385957ac9da610a6fb1938f4433ee40e47bdc5
5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
540be8c635852201795247d645c29293a6b7cb6d6fb05e22a8676b52d91fee19
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
563f81beb3f77223df0b04738213c7b911d686c367c85850ef4ca5245aabd087
569014b221a3fec6083500d09ecd17f8739b6466d374cb152be16c6bc1ff05cd
56b197972b901062f7ddd1da69d3cba8213671539f5b04272818cfb385de5301
59269992b50afa23926326e86714ae0e9507488992fe1975361422662ee6a2ff
5a252b9a96e5aa3f0dc99c702219819ddf46cfdfba95f2e00f4e5d32387a634d
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
67d0bdfdfd7aeda525143a544eae4164b01310d19d62149cd5d37304f0b42e51
6901a32f36d2f748532bc770ee035dc5583cbf3a30280a0f8a22ce2f35a93de1
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
6a65146e588cb9b4da0ed50d019fa26b01f86f969f642b3207fdf121a3f9a9ac
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000
6effd8b04358306dbc5dd017fa15e822ebe2ab13ca09489b6abccafe40287789
702cc4f159ee23725d889b620b5cbabd15cf4b564ccee60309f63a717f20bbb9
73c98920f05b2af9793c598970d1082b7c3a739ffea83dc981ecd550a25f93f2
74f314827ce393ef1a16ae0bce29826115f5d6ffe3c499c2e8dd13b59e98f268
75db7e0c2d51f8dc4f9841c3d8c6d9716df0964f0e51d54e8b6d428c2c0baf00
79df73fd1377483384f7b7565e98c4a430889f0388db05634271f9f302faeac7
7a471672f3f91ad82285192cae07b7e06f4b2baddec73d8e6898a1a445f5d0ea
7ac3677e23d988059a7f8ce54c455ff98cd2dbf163bf8bc1b6eaac75c838228d
7c3a6bd227deff6d6ed5db8c9fd6bd0246bc7a1424b0c025e341a6cf28ba5b61
7d0bb9556119625f4c7b1882f705e38fcfb5779a9d82985f8e96cb056d5a848d
7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56
7e1a265736848ddd027d8f640c0078da748d36604187ff08b55b9b8edab3f8f3
7f23af6adc7ea6c31b559530d3d85ae93198314ce5844b7d452a158a07432560
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851d3d9028e7f9b70c04b2e1a1c32b99e68f59395c95cc0e691cb1bb2fa7d4ce
856ca1ff9bf0886b1ca22ba2f59f0fe805be7dde4ed8e849a3aa2cb07d3f8cca
864b19efbddca842373a716d23fafeb056990174c8560865bf026dd1bc1201bf
86c9ff37ed0aeb828a6f1a889d0ac958e84e6f4d2317185fbc45a593b7ac156c
87b010edc18752647dcd8749bfe9abea7cb1eaf4f3ea4de0898b3ed325b1ed08
88209e5915d9576c860ffd0d4427f4231e3712812128457065205ef71d3bf8f5
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a5df07b019d5219014549abbca3d4cea8d07bd8983cef6165923909d5f62b3a
90281ef24e372fc058be5b33cd53e1eb7a71ab69628a09056c9f9bfdcecbd426
920d6ad6f88618b9536120a740d74c1523313fee1717ef5a75385da286808e8d
93bd03433acb8dab6ec72e7b9bc48b4997b673b2a3db67af26df2c2d49615262
94463d6613d2657c837b25ea591747d6ee86700dcaed5800f34591cf2230afb5
992c3b7f9e36464e9e12189dc404c5c781bcfbc7d65d0a1d9398b30d4b33913d
9e6f7293cff87de3e7b04c21a2eceb6e1ed3437f0bf8940b85d4fb62320f02fa
9ef22c9cf20460bbc639afd09b42f03a4e91db23bf8d774280653a7845b157de
a02f78e600e8272c473819f97a46a1c070f8ceeddaf29ac5655e371375e9456a
a120a51667f8a7d4c6202c1ca0df9a2a458633a96f2c1c57116434887a5d3565
a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b
a2cd69554b92111a977a7dad5894fab189378b6a52b754021100b9ab11a34489
a2fdfed84c31fff7b05803b3c1dc59a65956e4f0b1dbf13ce4b2340caa621c2e
a431b44f5dee485517960556b3400da39d89716fec8fa3d8691a66d3d42f8560
a6de4a5b2222641061566d4db422c7053695da84228170aed2644012d97e4bdd
a761989d03c3bc3c4f54e5b249fa4616c9ef6a3bac072d02789f69d44b2db102
a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c
a818e9f64e6062493c2f08078990ef5529ae59638c8202c690520ae905b35f0b
a82452bdcca8350391d6764cab7ab55714a8a6f758696ed531dbaca05fcbc7dc
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8
ab3df36974f582a3abb3c213becd606b9c36685c10bd92680c2caa9ccfb80242
ad494e9aacbcc5547f12c8293d92fa47e9e3597fe246bacc1f57efd2b400b437
adaf07c7701d826d9875cbb76bcb113ee13a1058ae744e4d18a10f2e4fed258c
afc1b28f4f82c7ced1664c9fdf044c4a2570ed9e96da9ed548103b7a01000b08
b0c94997af47d3645d2b36185b6b5aeb6bded75a3f966c5c903bd0461880c793
b0ee583ec077fde22c36c75a03d7c8e2bc82a78d6c11519e6178770132822260
b15aceb04dbf5604df5617cfe984f48479cb131c1df02825d1c24e9f35d01857
b346830ae8412dee5e7b821cf164d9cbc443ffdd606baaa37b2ef397aae14975
b3aa2c059437af622be6abf87d58e045c85321f5fa7a89d1a3e4c033aa4b5515
b442b9c90f01fbe2f938a6bd923f5f98b498b40badd2c4fd0dcad794114b1006
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
bcdfa6c6326a2b625cbc3665cc4e01ca4fe89ad31d377ab9ee5d92e63986a716
bd6e71e0a8f18b3dd4bbeb6fd673015fec896bd92e17c11f3dc8fe96a06de1f4
bd95e8a7f7c6225934f3f14a6cdc3876566284966667fc32f88fe141e3713da6
bdb9c31c82af189d8c6c851298ea91b1be792ae1745172232a9fe6b41499025d
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
c118d1fca2998e4679455c91d4a0eb4a516d3d49bff9540bca8e3c6d21118a2d
c24a1ab5a36b5ab1827da8c3fa51348be759febeaf3c67fbf46946cd08e0a4aa
c3f4864802c06951ceafa99a8fb279608ad8916696cadd3c0ec4ae6ddb1d8136
c4c1d392a90c31f031c21d7aa51f04d0bb359027db47c5234da034da75689961
c5015dd5691332e2f9a5e3ecd23c3e35ee9b6feea263be7d941d3c47d9e212da
c64fe067563ccdd39e1b62884b03c4191847f2649ff96b4857a868ca4d043038
c67d6a406ff72f17cfbbfaed1574f1ffce1d15c26c4496ebac83e606becda886
c78493afeeaa3ff629bf1327b46b6432e8e3bb1c8e05f7c890cb486fca7d5538
c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a
ca0ba71b383a70dfd62c73bd1676f387fc57f5dff42c2b805f5ab594114bce52
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa976b62fb6b8808a12c08ee3434d1b41d614d404674fd4a3fd7c0528c923f4
ccf2488b733f4b5da9265892abd5e37fa329c1020b4da7712c33fcd6e1f693f6
d077807b2373375b2d5c8ffbfeeea0bcb152e29c21ec147aecfab6b5502e5463
d3c1ab5f3efd97f3f199b2e3e5400c80bfb83324494c408dfc8d9a695fcd4712
d546596fae3c1ea8313f938f948c3bf85eb9a6357d145ce1c3f9a0dfb98e9f2c
d570f130ada6f735a85879c5a7b01c106bdd124b80892ed66af241dbf85b86e7
d6babd302465c4da1ecb58819a7ac7eeccac8c5673d87f733a3d676258cec6d4
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d8282af7cb6a3d9dacc0d3fa3d57e958b0fcc210d3acd82b2591ea7198421124
d87c999923b7320b6ddf3919e0d76f409d36048f087311a6ceaab267d182ed73
d890e2e4c70263205b52c10bac30491c0d7a13ebe5b3ee1123825eade66d097b
d8dbbbd487529ec5263ee6d39d97e2e919dc1c7b3e075dffaab7b5f4db89ee27
d9ebb8350799ffcdbd1143898dddc93a350fe53e2d790773a2510f9618966753
da0c53e8878f4d05a347a2edb7edcdb25e6c80dcea31f037b65c1103d0591a6e
da83fbbef0baaca05320982fb4bee293959ec222e4683ded73a621ed24dae559
dbc4c944a2abdd71f26c31458b90ae46a60fcb5f7673cf86e155755015282c03
dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682
dd3c89e4d3e2e8657acfae1476dccac31c9f0f0f37daeede38abcc8f9050622c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de530d97ee086c1c3765ee23249e028e2c3e47d83318e848a19812ef68966dc9
df5ea2615f1e65c25f3100090d372768cecf9c0485138bb61c5ccee0a1f42f2c
e0c3c1e9d6b575fee5fe7cfd2fc0c8731747221e25d451a23138b92d2b7d0d88
e190004f753344f8dca8e365f2f3b1ad003c2198ead3ced744018bada78952de
e36eef9fe41a6a81c62d8cadddeb7ef0c904dfc0fa1b6deff3314ef610f45a0c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e60dd33557688b0217cb7a3cf445daf12c7dafa288091961df70a48ced31872a
eafde1b9321c5218874c0c1058664721eaa0c69a6846fed417c392cd3c0d5418
eceea9ec229684ba339474ad50f60f0c8b08706c4e2bff6a7018d0f8eab579af
eea91a5722b6b36943fa218f20242fdb98bf41a350e75204765b2f843164ad25
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f1ce556665f40cf05d19b34b433fbcf4617673a73ee960beaee64405a3f6dbf7
f2c50a16459c96e45c44e339dba2764807e8c3a174cdd8804f3fbee6a6b19198
f58921ec9151a34826886c1f0cc2c18e289c5a77bae74084ca05084f298db597
f5a01f79f64d5b9ef018f69222a4b31357301ca04ed99ef802ad95e753c9a17e
f6a55e008070dfa78b131827c914ccaadf3de9ddaf61b0938b1dc46fa3ae337c
f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785
fb128d11873821d66616bc81a3229f7b664483472e52213dc15e39e5716d6dcc
fe6d410b84a3f94a20c4be9625ea8a41ec7f825e6e707ee6ee57d992f065cc5e
ff29561d28196b2e6106ed73de445b309a6b3d29c61b275ac06bea071b2d9095

www.spokesman.com Open in urlscan Pro 18.245.86.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

292 Requests

96 %HTTPS

0 %IPv6

61 Domains

80 Subdomains

71 IPs

7 Countries

6512 kBTransfer

20718 kBSize

29 Cookies

34 Outgoing links

Redirected requests

292 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

www.spokesman.com Open in urlscan Pro
18.245.86.10 Public Scan

Screenshot
Live screenshot

Full Image

292
Requests

96 %
HTTPS

0 %
IPv6

61
Domains

80
Subdomains

71
IPs

7
Countries

6512 kB
Transfer

20718 kB
Size

29
Cookies

292 HTTP transactions
8 data transactions