www.spokesman.com Open in urlscan Pro
18.245.86.11 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Submission: On May 11 via api (May 11th 2025, 7:55:17 am UTC) from US — Scanned from DE

Summary HTTP 281 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 68 IPs in 7 countries across 60 domains to perform 281 HTTP transactions. The main IP is 18.245.86.11, located in United States and belongs to AMAZON-02, US. The main domain is www.spokesman.com. The Cisco Umbrella rank of the primary domain is 313873.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 29th 2025. Valid for: a year.

This is the only time www.spokesman.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	18.245.86.11 18.245.86.11	16509 (AMAZON-02) (AMAZON-02)
6	52.222.236.85 52.222.236.85	16509 (AMAZON-02) (AMAZON-02)
8	3.161.82.35 3.161.82.35	16509 (AMAZON-02) (AMAZON-02)
6	142.250.185.104 142.250.185.104	15169 (GOOGLE) (GOOGLE)
1	13.35.58.60 13.35.58.60	16509 (AMAZON-02) (AMAZON-02)
4	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
3	13.35.58.11 13.35.58.11	16509 (AMAZON-02) (AMAZON-02)
1 14	104.20.37.218 104.20.37.218	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.19.220.32 104.19.220.32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	142.250.185.142 142.250.185.142	15169 (GOOGLE) (GOOGLE)
1 2	107.178.250.234 107.178.250.234	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.250.74.206 142.250.74.206	15169 (GOOGLE) (GOOGLE)
4	216.239.34.36 216.239.34.36	15169 (GOOGLE) (GOOGLE)
2	108.177.15.156 108.177.15.156	15169 (GOOGLE) (GOOGLE)
1	142.250.185.195 142.250.185.195	15169 (GOOGLE) (GOOGLE)
1	34.234.209.110 34.234.209.110	14618 (AMAZON-AES) (AMAZON-AES)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	13.107.246.45 13.107.246.45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
9	44.218.68.176 44.218.68.176	14618 (AMAZON-AES) (AMAZON-AES)
6	104.18.24.90 104.18.24.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	163.5.194.36 163.5.194.36	60558 (SECUREDSE...) (SECUREDSERVERS-EU PHOENIX NAP)
2	64.158.223.146 64.158.223.146	41041 (VCLK-EU-S...) (VCLK-EU-SE Conversant LLC)
5	143.244.200.230 143.244.200.230	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	34.247.115.141 34.247.115.141	16509 (AMAZON-02) (AMAZON-02)
2	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
2	178.250.1.38 178.250.1.38	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
5	89.149.193.80 89.149.193.80	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.)
2	52.222.136.19 52.222.136.19	16509 (AMAZON-02) (AMAZON-02)
2	143.244.197.139 143.244.197.139	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	34.120.63.153 34.120.63.153	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.1.1.166 34.1.1.166	15169 (GOOGLE) (GOOGLE)
5	3.72.6.211 3.72.6.211	16509 (AMAZON-02) (AMAZON-02)
1	13.107.246.60 13.107.246.60	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.26.5.15 104.26.5.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	104.18.94.41 104.18.94.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
33	104.26.2.180 104.26.2.180	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	142.250.185.74 142.250.185.74	15169 (GOOGLE) (GOOGLE)
12	104.18.40.68 104.18.40.68	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
3	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
1	13.33.187.112 13.33.187.112	16509 (AMAZON-02) (AMAZON-02)
4	151.101.130.133 151.101.130.133	54113 (FASTLY) (FASTLY)
1	104.16.80.73 104.16.80.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.217.163.217 52.217.163.217	16509 (AMAZON-02) (AMAZON-02)
50	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2	13.85.16.224 13.85.16.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	142.250.184.193 142.250.184.193	15169 (GOOGLE) (GOOGLE)
4	52.32.178.217 52.32.178.217	16509 (AMAZON-02) (AMAZON-02)
6	3.95.129.122 3.95.129.122	14618 (AMAZON-AES) (AMAZON-AES)
5	142.250.184.225 142.250.184.225	15169 (GOOGLE) (GOOGLE)
1	20.60.62.4 20.60.62.4	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	3.5.16.95 3.5.16.95	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	35.227.203.93 35.227.203.93	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	20.50.88.233 20.50.88.233	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	142.250.185.161 142.250.185.161	15169 (GOOGLE) (GOOGLE)
3	157.240.251.35 157.240.251.35	32934 (FACEBOOK) (FACEBOOK)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2.23.244.30 2.23.244.30	16625 (AKAMAI-AS) (AKAMAI-AS)
1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE Criteo Technology SAS)
1	18.184.119.72 18.184.119.72	16509 (AMAZON-02) (AMAZON-02)
1	35.214.136.108 35.214.136.108	19527 (GOOGLE-2) (GOOGLE-2)
1	34.224.66.164 34.224.66.164	14618 (AMAZON-AES) (AMAZON-AES)
1	52.213.109.81 52.213.109.81	16509 (AMAZON-02) (AMAZON-02)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	18.173.205.14 18.173.205.14	16509 (AMAZON-02) (AMAZON-02)
1	44.241.247.1 44.241.247.1	16509 (AMAZON-02) (AMAZON-02)
281	68

1 18.245.86.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-11.fra60.r.cloudfront.net

www.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.236.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-85.fra56.r.cloudfront.net

thumb.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.161.82.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-82-35.fra56.r.cloudfront.net

static.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.58.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-60.fra60.r.cloudfront.net

cdn-gateflipp.flippback.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.35.58.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-11.fra60.r.cloudfront.net

prod.adspsp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.20.37.218 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

widgets.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.220.32 (None, )

ASN13335 (CLOUDFLARENET, US)

sdk.mrf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.206 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.239.34.36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.177.15.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wr-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.234.209.110 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-234-209-110.compute-1.amazonaws.com

p.flipp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 13.107.246.45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cdn.wgchrrammzv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.q0losid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.a3kvau184uea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.sy57d8wi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.e3fbosf1tz3d.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.pranmcpkx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 44.218.68.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-68-176.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.18.24.90 (None, )

ASN13335 (CLOUDFLARENET, US)

events.newsroom.bi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 163.5.194.36 (Amsterdam, Netherlands)

ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.158.223.146 (Amsterdam, Netherlands)

ASN41041 (VCLK-EU-SE Conversant LLC, US)
PTR: ams02-convex-float1.dotomi.com

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.244.200.230 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

exchange.kueezrtb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.247.115.141 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-115-141.eu-west-1.compute.amazonaws.com

hb.minutemedia-prebid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.215 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.38 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

grid-bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 89.149.193.80 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL)

prg.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.136.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-136-19.fra50.r.cloudfront.net

hb.yellowblue.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.244.197.139 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.63.153 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 153.63.120.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.1.1.166 (Paris, France)

ASN15169 (GOOGLE, US)
PTR: 166.1.1.34.bc.googleusercontent.com

hb-api.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.72.6.211 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.246.60 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.5.15 (None, )

ASN13335 (CLOUDFLARENET, US)

api-mg2.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.94.41 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 104.26.2.180 (None, )

ASN13335 (CLOUDFLARENET, US)

givebuttercdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.74 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f10.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.18.40.68 (None, )

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.64.176 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.187.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-112.fra60.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.130.133 (San Francisco, United States)

ASN54113 (FASTLY, US)

js.braintreegateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.80.73 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.217.163.217 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

paywall-ad-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

50 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-spokesman-proxy-connext.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f1.1e100.net

6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.32.178.217 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-178-217.us-west-2.compute.amazonaws.com

adspsp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.95.129.122 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-95-129-122.compute-1.amazonaws.com

ph.givebutter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.184.225 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.60.62.4 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prodmg2.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.5.16.95 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3.us-east-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.203.93 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 93.203.227.35.bc.googleusercontent.com

pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.50.88.233 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.161 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f1.1e100.net

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.251.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.23.244.30 (Doha, Qatar)

ASN16625 (AKAMAI-AS, US)
PTR: a2-23-244-30.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.119.72 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-119-72.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.136.108 (Groningen, Netherlands)

ASN19527 (GOOGLE-2, US)
PTR: 108.136.214.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.224.66.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-66-164.compute-1.amazonaws.com

ssp.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.109.81 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-109-81.eu-west-1.compute.amazonaws.com

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.205.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-14.fra56.r.cloudfront.net

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.241.247.1 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-247-1.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 121 6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 178	454 KB
33	givebuttercdn.com givebuttercdn.com — Cisco Umbrella Rank: 138103	928 KB
20	givebutter.com 1 redirects widgets.givebutter.com — Cisco Umbrella Rank: 69010 givebutter.com — Cisco Umbrella Rank: 50471 js.givebutter.com — Cisco Umbrella Rank: 157697 ph.givebutter.com — Cisco Umbrella Rank: 143017	592 KB
15	spokesman.com www.spokesman.com — Cisco Umbrella Rank: 313873 thumb.spokesman.com — Cisco Umbrella Rank: 274006 static.spokesman.com — Cisco Umbrella Rank: 350332	1 MB
12	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 2247 ka-p.fontawesome.com — Cisco Umbrella Rank: 3595	34 KB
11	matheranalytics.com 1 redirects js.matheranalytics.com — Cisco Umbrella Rank: 17121 www.i.matheranalytics.com — Cisco Umbrella Rank: 16131	45 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 59	43 KB
7	adspsp.com prod.adspsp.com — Cisco Umbrella Rank: 29334 adspsp.com — Cisco Umbrella Rank: 25631	151 KB
6	sharethrough.com btlr.sharethrough.com — Cisco Umbrella Rank: 1168 match.sharethrough.com — Cisco Umbrella Rank: 678	675 B
6	newsroom.bi events.newsroom.bi — Cisco Umbrella Rank: 6498	2 KB
6	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 259 stats.g.doubleclick.net — Cisco Umbrella Rank: 171	224 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 58	670 KB
5	smartadserver.com prg.smartadserver.com — Cisco Umbrella Rank: 1895	2 KB
5	kueezrtb.com exchange.kueezrtb.com — Cisco Umbrella Rank: 2378	372 B
5	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 750 region1.analytics.google.com — Cisco Umbrella Rank: 4582	10 KB
4	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 428 ep2.adtrafficquality.google — Cisco Umbrella Rank: 438	25 KB
4	braintreegateway.com js.braintreegateway.com — Cisco Umbrella Rank: 9099	58 KB
4	stripe.com js.stripe.com — Cisco Umbrella Rank: 1231 m.stripe.com — Cisco Umbrella Rank: 1237	178 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 215	158 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 505	264 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	215 B
3	e3fbosf1tz3d.xyz cdn.e3fbosf1tz3d.xyz — Cisco Umbrella Rank: 35724	645 KB
3	media.net prebid.media.net — Cisco Umbrella Rank: 1120 cs.media.net — Cisco Umbrella Rank: 1017	2 KB
3	criteo.com grid-bidder.criteo.com — Cisco Umbrella Rank: 1215 dis.criteo.com — Cisco Umbrella Rank: 832	1 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1373	16 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 738	905 B
2	azurewebsites.net prod-spokesman-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 460308	1 KB
2	amazonaws.com paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 49035 s3.amazonaws.com	141 KB
2	pranmcpkx.com cdn.pranmcpkx.com — Cisco Umbrella Rank: 42858	3 KB
2	cloudflare.com 1 redirects challenges.cloudflare.com — Cisco Umbrella Rank: 2199	16 KB
2	omnitagjs.com hb-api.omnitagjs.com — Cisco Umbrella Rank: 5161	1 KB
2	servenobid.com ads.servenobid.com — Cisco Umbrella Rank: 3316	1 KB
2	yellowblue.io hb.yellowblue.io — Cisco Umbrella Rank: 1644	1 KB
2	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 317	1 KB
2	minutemedia-prebid.com hb.minutemedia-prebid.com — Cisco Umbrella Rank: 5009	943 B
2	dotomi.com web.hb.ad.cpe.dotomi.com — Cisco Umbrella Rank: 6240	1 KB
2	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 836	221 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 567	267 B
1	lijit.com ap.lijit.com — Cisco Umbrella Rank: 844	193 B
1	disqus.com ssp.disqus.com — Cisco Umbrella Rank: 1474	41 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 430	183 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 465	239 B
1	pymx5.com pymx5.com — Cisco Umbrella Rank: 101618 api.pymx5.com Failed	9 KB
1	windows.net prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 103698	14 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 608	7 KB
1	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 17229	44 KB
1	db-ip.com api-mg2.db-ip.com — Cisco Umbrella Rank: 29578	993 B
1	sy57d8wi.com cdn.sy57d8wi.com — Cisco Umbrella Rank: 57608	226 KB
1	a3kvau184uea.com cdn.a3kvau184uea.com — Cisco Umbrella Rank: 59246	27 KB
1	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 3395	28 KB
1	q0losid.com cdn.q0losid.com — Cisco Umbrella Rank: 54467	1 KB
1	wgchrrammzv.com cdn.wgchrrammzv.com — Cisco Umbrella Rank: 107016	14 KB
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 535	98 B
1	flipp.com p.flipp.com — Cisco Umbrella Rank: 14635
1	google.de www.google.de — Cisco Umbrella Rank: 9545	63 B
1	mrf.io sdk.mrf.io — Cisco Umbrella Rank: 8621	48 KB
1	flippback.com cdn-gateflipp.flippback.com — Cisco Umbrella Rank: 13838	33 KB
0	aamsitecertifier.com Failed aamcftag.aamsitecertifier.com Failed
0	cloudfront.net Failed d31qbv1cthcecs.cloudfront.net Failed
0	circularhub.com Failed api.circularhub.com Failed
281	60

	Domain	Requested by
50	pagead2.googlesyndication.com	az416426.vo.msecnd.net securepubads.g.doubleclick.net www.spokesman.com pagead2.googlesyndication.com ep2.adtrafficquality.google
33	givebuttercdn.com	givebutter.com givebuttercdn.com
12	givebutter.com	1 redirects widgets.givebutter.com www.spokesman.com givebuttercdn.com givebutter.com js.givebutter.com static.cloudflareinsights.com
11	ka-p.fontawesome.com	kit.fontawesome.com www.spokesman.com
9	www.i.matheranalytics.com	www.spokesman.com
8	static.spokesman.com	www.spokesman.com static.spokesman.com
7	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.spokesman.com
6	ph.givebutter.com	givebuttercdn.com
6	events.newsroom.bi	sdk.mrf.io
6	www.googletagmanager.com	www.spokesman.com www.googletagmanager.com givebutter.com cdn.sy57d8wi.com
6	thumb.spokesman.com	www.spokesman.com
5	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.spokesman.com
5	btlr.sharethrough.com	prod.adspsp.com
5	prg.smartadserver.com	prod.adspsp.com
5	exchange.kueezrtb.com	prod.adspsp.com
4	adspsp.com	www.spokesman.com
4	js.braintreegateway.com	givebutter.com
4	connect.facebook.net	givebutter.com connect.facebook.net www.spokesman.com
4	maps.googleapis.com	givebutter.com maps.googleapis.com
4	region1.analytics.google.com	www.googletagmanager.com
4	securepubads.g.doubleclick.net	www.spokesman.com securepubads.g.doubleclick.net
3	www.facebook.com	connect.facebook.net
3	ep2.adtrafficquality.google	securepubads.g.doubleclick.net ep2.adtrafficquality.google
3	js.stripe.com	givebutter.com js.stripe.com
3	cdn.e3fbosf1tz3d.xyz	cdn.wgchrrammzv.com cdn.e3fbosf1tz3d.xyz
3	prod.adspsp.com	www.spokesman.com prod.adspsp.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	prod-spokesman-proxy-connext.azurewebsites.net	cdn.e3fbosf1tz3d.xyz
2	cdn.pranmcpkx.com	cdn.e3fbosf1tz3d.xyz
2	challenges.cloudflare.com	1 redirects givebutter.com
2	hb-api.omnitagjs.com	prod.adspsp.com
2	prebid.media.net	prod.adspsp.com
2	ads.servenobid.com	prod.adspsp.com
2	hb.yellowblue.io	prod.adspsp.com
2	grid-bidder.criteo.com	prod.adspsp.com
2	ib.adnxs.com	prod.adspsp.com
2	hb.minutemedia-prebid.com	prod.adspsp.com
2	web.hb.ad.cpe.dotomi.com	prod.adspsp.com
2	prebid.a-mo.net	prod.adspsp.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	js.matheranalytics.com	1 redirects www.spokesman.com
1	m.stripe.com	m.stripe.network
1	us-u.openx.net
1	ap.lijit.com
1	ssp.disqus.com
1	x.bidswitch.net
1	match.sharethrough.com
1	dis.criteo.com
1	cs.media.net
1	pixel.rubiconproject.com
1	pymx5.com	www.googletagmanager.com
1	ep1.adtrafficquality.google	az416426.vo.msecnd.net
1	s3.amazonaws.com	cdn.e3fbosf1tz3d.xyz
1	prodmg2.blob.core.windows.net	www.spokesman.com
1	6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	paywall-ad-bucket.s3.amazonaws.com	www.spokesman.com
1	static.cloudflareinsights.com	givebutter.com
1	cdn.plaid.com	givebutter.com
1	js.givebutter.com	givebutter.com
1	kit.fontawesome.com	givebutter.com
1	api-mg2.db-ip.com	cdn.a3kvau184uea.com
1	cdn.sy57d8wi.com	cdn.wgchrrammzv.com
1	cdn.a3kvau184uea.com	cdn.wgchrrammzv.com
1	az416426.vo.msecnd.net	cdn.wgchrrammzv.com
1	cdn.q0losid.com	cdn.wgchrrammzv.com
1	cdn.wgchrrammzv.com	static.spokesman.com
1	idsync.rlcdn.com	www.spokesman.com
1	p.flipp.com	cdn-gateflipp.flippback.com
1	www.google.de	www.spokesman.com
1	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
1	sdk.mrf.io	www.spokesman.com
1	widgets.givebutter.com	www.spokesman.com
1	cdn-gateflipp.flippback.com	www.spokesman.com
1	www.spokesman.com
0	api.pymx5.com Failed	pymx5.com
0	aamcftag.aamsitecertifier.com Failed	www.spokesman.com
0	d31qbv1cthcecs.cloudfront.net Failed	www.spokesman.com
0	api.circularhub.com Failed	www.spokesman.com
281	79

This site contains links to these domains. Also see Links.

Domain
checkout.spokesman.com
myaccount.spokesman.com
pics.spokesman.com
www.addressspokane.com
pets.spokesman.com
twitter.com
www.reddit.com
apnews.com
www.facebook.com
www.instagram.com
www.tiktok.com
x.com
spokesmandigital.com
www.legacy.com
cowlesco.vistahrms.com
www.linkedin.com
api.whatsapp.com
pagead2.googlesyndication.com
adssettings.google.com

Subject Issuer	Validity	Valid
spokesman.com Amazon RSA 2048 M03	`2025-01-29` - `2026-02-28`	a year	crt.sh
*.google-analytics.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
flippback.com Amazon RSA 2048 M02	`2024-08-18` - `2025-09-16`	a year	crt.sh
*.g.doubleclick.net WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
prod.adspsp.com Amazon RSA 2048 M02	`2024-11-01` - `2025-12-01`	a year	crt.sh
widgets.givebutter.com WE1	`2025-04-24` - `2025-07-23`	3 months	crt.sh
sdk.mrf.io WE1	`2025-03-16` - `2025-06-14`	3 months	crt.sh
*.google.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
*.google.de WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
flipp.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-28`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2025-02-06` - `2026-03-05`	a year	crt.sh
cdn.wgchrrammzv.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
www.i.matheranalytics.com Amazon RSA 2048 M03	`2024-10-16` - `2025-11-15`	a year	crt.sh
givebutter.com WE1	`2025-03-28` - `2025-06-27`	3 months	crt.sh
newsroom.bi WE1	`2025-05-04` - `2025-08-02`	3 months	crt.sh
*.a-mo.net R10	`2025-04-30` - `2025-07-29`	3 months	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2024-06-17` - `2025-07-19`	a year	crt.sh
*.kueezrtb.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-14`	a year	crt.sh
*.minutemedia-prebid.com Amazon ECDSA 256 M03	`2025-02-17` - `2026-03-19`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2025-02-21` - `2026-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-18` - `2025-07-17`	3 months	crt.sh
*.smartadserver.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2025-01-09` - `2026-02-09`	a year	crt.sh
*.yellowblue.io Amazon RSA 2048 M02	`2025-02-16` - `2026-03-17`	a year	crt.sh
ads.servenobid.com R10	`2025-02-27` - `2025-05-28`	3 months	crt.sh
prebid.media.net WR3	`2025-03-26` - `2025-06-24`	3 months	crt.sh
omnitagjs.com Sectigo RSA Domain Validation Secure Server CA	`2024-07-02` - `2025-08-01`	a year	crt.sh
*.sharethrough.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-07-15` - `2025-08-15`	a year	crt.sh
cdn.q0losid.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
az416426.vo.msecnd.net GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2025-04-30` - `2025-10-30`	6 months	crt.sh
cdn.a3kvau184uea.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2025-01-07` - `2025-07-07`	6 months	crt.sh
cdn.sy57d8wi.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
cdn.e3fbosf1tz3d.xyz GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-24` - `2025-06-24`	6 months	crt.sh
db-ip.com WE1	`2025-05-04` - `2025-08-02`	3 months	crt.sh
givebuttercdn.com WE1	`2025-04-16` - `2025-07-15`	3 months	crt.sh
upload.video.google.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
fontawesome.com WE1	`2025-04-28` - `2025-07-27`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-02-17` - `2025-05-18`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2025-04-01` - `2025-07-10`	3 months	crt.sh
secure.plaid.com Amazon RSA 2048 M02	`2025-02-19` - `2026-03-20`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2025-01-10` - `2026-01-09`	a year	crt.sh
cloudflareinsights.com WE1	`2025-04-27` - `2025-07-26`	3 months	crt.sh
cdn.pranmcpkx.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-12-27` - `2025-06-27`	6 months	crt.sh
*.s3.amazonaws.com Amazon RSA 2048 M01	`2025-02-14` - `2026-02-07`	a year	crt.sh
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 03	`2025-02-01` - `2025-07-31`	6 months	crt.sh
adspsp.com Amazon RSA 2048 M02	`2024-11-05` - `2025-12-03`	a year	crt.sh
ph.givebutter.com R10	`2025-05-10` - `2025-08-08`	3 months	crt.sh
tpc.googlesyndication.com WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
*.blob.core.windows.net Microsoft Azure RSA TLS Issuing CA 07	`2025-01-22` - `2025-07-21`	6 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2025-03-20` - `2026-03-19`	a year	crt.sh
adtrafficquality.google WE2	`2025-04-21` - `2025-07-14`	3 months	crt.sh
*.pymx5.com Go Daddy Secure Certificate Authority - G2	`2024-07-13` - `2025-08-14`	a year	crt.sh
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 04	`2025-02-21` - `2025-08-20`	6 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2025-03-04` - `2026-04-03`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-23` - `2025-10-22`	a year	crt.sh
*.bidswitch.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-04-06` - `2025-07-01`	3 months	crt.sh
ssp.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2025-03-31` - `2026-03-31`	a year	crt.sh
*.lijit.com Amazon RSA 2048 M03	`2024-10-21` - `2025-11-20`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2024-08-14` - `2025-08-18`	a year	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2025-04-01` - `2025-07-10`	3 months	crt.sh

This page contains 12 frames:

Primary Page: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Frame ID: 92CA5D83F901416E8FD092C289E54F61
Requests: 149 HTTP requests in this frame

Frame: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Frame ID: E2AEA589569918A3A67C649DE7790F03
Requests: 76 HTTP requests in this frame

Frame: https://6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Frame ID: 4466D444E40187518D494A3D2FF376E7
Requests: 1 HTTP requests in this frame

Frame: https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js
Frame ID: 2F5FF6FC17FE1C0D6B060AF139831F7B
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsv2V75pFxb2H4RokmqrWKs7zYC0cG73zjpyfzYtOkpupBx4z1qFI-uthAKeHHEsTY9UnSOsKIP111bU2L1xgioOTm7bfhbyI_Z8Hf4FWS7rq1JCZF1XGG-wHV3eQfHVFaXDqq4yKD7N_x7ONId7WJ0j3edF7Isb8pIhxsohsxWZ3qQw4r7vFymrUCRy1lpbmbpnogM37fwA6yVsE3vKVMW2cOfVWJghYauRoR-OUi3586MIoLZWtCW3Iwf23IfCJwL1wH4kfGLno0lOrIwA1uo577ZmY1qhOKab3LLux45m_H2Ns4qb2r-EhBrZVQjPhj84y25wIVqDvwthepqkoPKqFK4Uqaz9eOc9SHmx1DS2TaFPlBoln0RSmcBHo-xVt7UsSo9sHNUk65Nx7DJ3vH8oJwOrqEYNONao4kks-hS_FqtCdx3MiF1vLMXANSKFaaABp65ki9GzdSFn4qo&sig=Cg0ArKJSzJyu-8pWzQhsEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 4D1599DB9323459692F7BA9038FA0BD4
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssxRC79w-mNe4WWVciv9k9s1Dmbc4gae0lHYNMA7VEZ4pdiSgIniQTlO56Mp9aBKJHsejlDI-BVymJogNVtFkj4jVcHtiZBcLI69HBzpVn0aprVdJ5qA1ldTfMf-n3Xjb_mrBuCIKfIWYafrKQAtvgy14WuOfH5i03jbeOzFP7hL54I7vgmeHwE4TM-O_pFx_jF-c9l8S2NH4beggrG9ppoUNF6oVN83g8MNocg0dLriBd_b1j1q3cu64HrhO349j9zAoASD-a2_UqPJxLLK_5CMC5m43MjtB6yEYW5kvYinGYKzw-RrZQtRxQTCUtOlcK2xByZ_1gqI0QTqSeUNDnLX3WhCi7u4eqM9sajBMehMdMw_1Hks8eI6kEfBEdk_-gQck8s_v1DYSLERA2whTTMAs9ppSnIAsXjxNl_opDmjTv0EgdTrafcXp2L-eKwKYBMaiIKvv6MG0mjkJdJ&sig=Cg0ArKJSzLPUvRHBTQzfEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 9634BC058390E1588B468C7FC72C835C
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvWcT5hHE7Ne-muS3zSg3hW3q6oa8tln5QFLzqcKN8IRe6Ma20P0hHn4ugxm6pMUjvt4_Cqiq5qNJc_gAXh9AEpc-_eL8bvNKaQQAc_fSNiUd4mEHtJSGE0K4zb4TT_2bwwyQG8GdZl02Tc0c80Y3nTU_EEZJgfMuSshDJA9rhU-bVmOoOLXjwcPiG5_qtwqqCnh3ErZPTR9lO4NhpqgBj0DtlqjuJtbyeePxNJS_PrtVoST3EbO3RaZGFBZZm0ngh-1Wlo1CuXKipnNaupH6mfV_i17oRWkgJEf6yaeefSk9xzPYJFoVpWqxuWfn9Wv3bqR30be-bhDBeLHkDJk-9yFNcEb5Yrk11b75hkHXHItLYLL8ndYI7d5P5kjsNkELSxmEAYYtSirnxPqEbWFZ-3LrhYdk1Qbb04uvv0tLWB8w0E1zrNhRC22lawWxJOCSJfnFU8RFjIzQ&sig=Cg0ArKJSzPPjNaQWK17OEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 26D0E4865310F4BD46B8C0651296AF8F
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvujNd1K1V38qJH98rbkgQOgLMX4cqbvCV5vJwciNxPbm1oGiRSMhuexsRUNoTPBDVi0pTqo_I4nU-QoREHTy6UM8NAJf6p9p4Lp2QBKqyBmPFVBZIqtsay0q_6Hp_YMeHvBKajUQzF2UHHrYeqB06dYtul4MOVe_IU8w2gWKyYl52wQDSq_C3QVivb_5aOrJ7b2C2v7NHaxgookyZdvmwFfbr77_RQmQdqLQ2U5OJgI3nejcMUY5QUft31EQrcOddLr3FNIKCgT3Zb1TM0_ntxsamXcVxzChW9QgFYLK2DUgqTM8fc78cDjiHiagifQjc_dBQSwNTFYiWbd0lVucQmvXwLgZWustbQ9VUyb6quvQ-uPj2rFIidvY-_BWjFuRwc7ztqSwESMq-k7HS-CIYyY8-brSk4-9GjR1HsekPRU_mTuZeMaa6lZC0FR3BRq2U38v6CQ5mz8OmfixBeOlo&sig=Cg0ArKJSzEQ9xjs-1IF6EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: E79C61800BE1D5AE6A3F89A28BC95E75
Requests: 10 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html
Frame ID: CD92E8A7599B7CF8CEB9E09FCCB76B96
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsueIUArVwg-Nm2AEhvgc0aSv0Trk3blg4mcosJ09dxMvIBSPh0uY1PE4tkkwLSBILtO_3U2QtKFfSzaq2Kg4V13jmdH1umbz7Gf2ggLnDPmCXKuI_ZqqhavOaTmskr_k8WpUx-04Fza0ZmZNQckYCnTG_RM2v8nlN9bIRABbvHDGU-Ilj-Nc3kUlBR4amwnOxBLm3JHFASxO0-pVSC6_Ix2FWhMxQLcLU_zaPyQIKyUV_jFqynq4asLlGP23WxkZ1AnGnSnSDCP3JoXOU-qukHRc_2e79cTVSnkdjTfcpgGf7YsKBhgK7MzzuQAfYcUlgaxJc35yHNTo3TV30x1m4s_on_9WvH9O1qC4NU7zrUWVOzIMylIWssxnaXumFeBUqFCYhnV-9hQReDxrJgwSleKcC6fFcSaPuklZAv308ahfuou3uLAYnFXH2DZ9Q1KVBho9mT-BK4bvFh65QyMTps&sig=Cg0ArKJSzP7hKy9jEDbZEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 14EE1DBB8A86E9FA58CC70BA5B829FA5
Requests: 11 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: 43A92F7B7B9598F90B420FFE366EA73D
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: A8C6BC6361E6BB3AD1E9001FA3521F61
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Panel finds 80 alleged abuse cases tied to WHO's Congo work

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Braintree (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.braintreegateway\.com

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

MailChimp (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

s3\.amazonaws\.com/downloads\.mailchimp\.com/js/mc-validate\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

281
Requests

97 %
HTTPS

0 %
IPv6

60
Domains

79
Subdomains

68
IPs

7
Countries

6450 kB
Transfer

20343 kB
Size

30
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=header
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/Home?SiteCode=SR
Title: My account

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/
Title: Log in

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=default
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://pics.spokesman.com/
Title: Buy Photo Reprints

Search URL Search Domain Scan URL

URL: https://www.addressspokane.com/
Title: Homes/Rentals

Search URL Search Domain Scan URL

URL: https://pets.spokesman.com/
Title: Pets: Jimmy's Clubhouse

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/
Title: Subscribe now

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&url=https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Title: X

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/&title=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work
Title: Reddit

Search URL Search Domain Scan URL

URL: https://apnews.com/article/united-nations-europe-ebola-virus-entertainment-coronavirus-pandemic-d14715ba3653753d7c1f122f8aea79de
Title: investigation

Search URL Search Domain Scan URL

URL: https://www.facebook.com/spokesmanreview/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/spokesmanreview/?hl=en
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@thespokesmanreview
Title: TikTok

Search URL Search Domain Scan URL

URL: https://x.com/SpokesmanReview
Title: X

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?stateInfo=&source=external
Title: Print edition home delivery

Search URL Search Domain Scan URL

URL: https://spokesmandigital.com/
Title: Spokesman Digital

Search URL Search Domain Scan URL

URL: https://www.legacy.com/obituaries/spokesman/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://cowlesco.vistahrms.com/application/login/login.aspx?ReturnUrl=%2f
Title: Cowles Company Jobs

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/Engage?ofrgp_id=735&zipcode=00000&g2i_or_o=MG2&g2i_or_p=5167&g2i_source=1stArticleBanner&g2i_medium=FTVRW&g2i_campaign=Engage&G2I_ActionId=101609&returnUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F%3FclearUserState%3Dtrue
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://givebutter.com/support-local-journalism
Title: Facebook

Search URL Search Domain Scan URL

URL: https://x.com/intent/post?url=https://givebutter.com/support-local-journalism&text=Join%20me%20in%20raising%20money%20for%20Comma!%20via%20@givebutter
Title: X

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://givebutter.com/support-local-journalism
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Join%20me%20in%20raising%20money%20for%20Comma!%20https://givebutter.com/support-local-journalism
Title: WhatsApp

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjssR5eWMThddsyd0vVdcNzXV7LIEeZgaVahiedHDbQ_b5_Vnaprew74X8rKMI35ieA3ahAfXJoB54s8IsPCSCiXn0M1U6Wq-CEXNeW65dAq_lQrc9_h5Ug8nzac7rvPJizemRLbDTvnCkOdLBZ-V1kc78IDlyuC72g3VeTqY991pk7iiPg1yy6Z3xzKZWX673sTzkfFpxAqf3Bt24miGNn2wis7-qwP_UJDkg2jCVo5_rgsMpefZEA1LjIFsXuToxFjhUEDP__BjRSELLY-ALVic35dvZiXVsimLVfSmso_v8UjNuv2WBcTA0WUTV5tQuF4T26VsivXb8eCTVvX0jtVZ5aPJSx0cdJyBudKUF0xG6tUx18BaqDkIxlUTHI2k1PiHE75hENICMz6Q38GPJqZdou5qBl7zBRPNJa8smcu04xM9QlBFyhIm&sig=Cg0ArKJSzN7-8quZQH8a&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://bestblindsandawnings.com/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQYmn2z8UP-nJeYPVrBc6pAMwoVTaVgs1npBlfidfRI1mwiWbd6SDaP_jnTst9OZrf_XvOlJlFGbouE_WzMR0s97YIm7hXg8CR03kC8pAMbSb2c4jwlU0gdXipyYnmoRxO2xD0oksB2pDksI9_U7EC3-e_NyaaK2FXfmQfjpn7CqgVAonGa4jy0bWbFZLLep9akXelE7ilsZ-cD2VP09hW_rXgWrpkaMgnKNCpep-422uDmyz80OGfjooZDEwp2nAV2JP5QjkeHml4FpN2LWMFPz1kAco5PwyYpJCNY4_oyOQvqmrIGavCAMGfF7WqJGslDMvVw92g-azwWjLM6pQWhrt9PI_CExnD-XZoW_j3tgPMQvRyBt_zLPnvRoeSFNT6wwm7Fg7_n0gTYjKCvCvOcl6ScBhimRfO1zOMapfveJog8ooBROhEgC7WCQuY2VFEWX4QUIiQeL9OLg0UG38dDv1rcApG6mkq7W0dCdHDxnKCLuI28CXB5f6kCIMYo3jIDtFMzWS0-ALkPxLuIcVOh-mpQWqO1udFbwgK1V5ALLNdwesdGfA9fi7XcKsrAHa-sY2rxZf3nSTfItU6Hjb4XtDAdrHL3E3RtmQalTcq40aUGrkJikpCOxbNDhBMkbNmzNQe1l6ej7IH0IprQU01UCGF9uGyVUUi1ESTtPOKnOBEWJm6droHNo17vUjZ8PE27qojAFxzk9th2I7kwddoW6sA_8zesJc2AZHhLIs9iMyr1Ei2Ir-PX5Vikoig7PIxlZsrRiz11nvDW6yeYJvTPASai7krW1keH603GhA4aHoHzNeVAqtFP1e8cm1DmxIbydDKl5mfyqWakG2RCr10mAcFRHlT7plnyd9vXGXak0fC8xPOodUhDnULsHivGpBYfBfavAznADrFIFiwiDFw_uImrkaroFPAA05myNrR5VR6t-IjbKhfmmZzRwZEIykftWt3qEr0qmOJV1fKw3sVarEZnKKKvXblLIKIA-I-MqjEuhg3eF-Mz4v0xhUTjOozXSO_gaqnnpDHsN0lqFkp7mJWbyF2bQ6vmHF0U6g2LviyPMQ4RBCabAM7KziFcccgBeT87fXyepJPTX3Scr9sR-WgD9YAe2RR836G2Ip3DmTHREdRrpP2uzlKVUWtwPoR4FVtBAp0-1aZ5CLmIIbhm6obnDuQktDRTERkWC9VYZip6Xsnph8vwOMg2H0Y7KFffcWlxYUoQ31Crr12YfoSc2RsFFwiM3VIf0BPv5BjGm-N8sy3mTI5_1GxhC23xLMeaZRkl-haDBtvZlP8JTYQmKB70b2wcrtzVI276CJOYxmtZEBTuGtoS9Obb5uZ1bVaIkE90XOasVpe7mKxtfooz1rLm9o4A3w8EQVBvjzT60Iid_qdXtrEgA_oGOTbEpIBOl_RhAgex7Raevg&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsuziO1SyDgOOgv4wslE3jhHgPIjpS9Cy1WoWhlTg20MnDus7_OQklffei3GJwcJxO-9-JFU1Tb4-GCD9FbEsLo49XUH_cdbWQ3Yy1NSEM_iisGARcIhD6HsHrzqzqlNr4kdNwWkxS1cFM-bWrzJSD9aIWjqxiSL7AMj0MI_l_tg39G_bdg10GtyIYy2aOsnX2Buv-NDTWq2QxBgtm-8fnJ5WICr9iKI2yIWifhpfjfdrWO85IrT-O_28ISK6zx3taLYuwfUHqWMxbRMibnhFrDGZeqPB8aKywm5yT3p4urci3rGveOLxBdfUFeI47IxVGekO5VL7xghE-ya7s41M2ZBZt48quEpGqunC512FcaDY6hbt70O0VGY4Is_k4uvBDUWlQK9EI8XQBzQQzh_VFuxGSUX2f-2PT86YvarFYZHbb0tas6kOK-Feg&sig=Cg0ArKJSzOfih32Gd3fI&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://bestblindsandawnings.com/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJESRa_dUXjia7yp4PW6F66CUSABSolKDe91C1lupm6F3QTdY2tV2ueKvScake6r8SeWUzv6NyTM3EZFlsXKu2wT7TsRkAfiDhRC97b5utZwNKRbdR_NB3_BF_7sGuI6UaXgxffNpMnZ3TynHnL8BuX8Zt69FSBCPwejw7zpYyDuJuibB93c7rANS8QzhAqvhekLN0CNvTqnBRskleOqg9VemmyfiNiQJfB9nucPudzxxwQeTEE4irNGIW_bk9d7BUXwul993tp462F3KDZMerOfJ7xYBFo2MSza3fgCF1iMxL3XEHwPHaSALweWEkljW6oj8MZz2Q89-mV6t_ZZknbZtvbmk5Hor_tnXwgrmbnmJXEd4Y1MoGzvvxtsM9y6eDHxFjbbXcZkumf90Ds6kaxQwC5975PUE1h24HC9NpJiYlZsPUEtbwW4zfvBeqvZoFhZCBc67mp5hgcceBbQJnt8crUX4S-lwuAKja8N1v9d4weNh4J58H-AZoDkvDGERr_Yb7Otiy81QD5II7ultKouX9cQSHaLM1djwqVY1grNNrVTfB3l336aZ4v5X-Ma0BOp2sgOBujIurJygY6XxD1moWQRBZbfARy6z0a00rVfbnRrB-1Qzf7CdbWGXGBxPZYWqLuEm_9ufC3Y804TzL_4la_NQfjpWb6WgCSmT9XiSkiMrHGtU9kaMtwX1n__YW19PmoJISE61dvUP_GmjcCtSDLSRL2TUe1gGytCixSyU3WiKJEn-WLQh8RrcK3v8zdRGbz0S5CNXa_Gr7H6ctwqDsH1cjWDVG6X2Bj_1skNs6YeaJ0hK37Mo6IhQ6p0nVF1qrxT-vRKMprVXPfp8_DR96ltW9NwofSyE-raVvdJtLV9_u4puTYb3nfSP5rODsIVwZkyn7bbCtvbYGbXTIDrP5uNZrIzD0nkWNt7AenCUemCfywY8q9xVpXG-gi_v4rjDjTyYI2Y91xiY9ioU4TLiEfrg71EXHR-Guf9PvMvBZlR30_6hMl9VLBBxdc91LadLUzZpJ9grcQrcAg0nQalBwc7MzJ0aVkB21lTS7kJ1k0mg5mZ4V9-i_7BC_l7p7QI84ImtmUadOeqW4jzVKF5e97fglyhnTNFSL8Y8P8asHqd38sH7upMnpN8FRUUwguFL-riQ_2w17JqJy9eraljXxMuV4YWGg4c_f2k2zzgGxYWhgoCjOqmHdlyeHHGACP8ubZxZG7_Fo-2ngZTmCQKMhyn454426lp3GcZ0IHsNJbX4ShqcbwyU1XoPZmC358vG_zxvuBajplJUzAFLqKkXLaKR9QSJd2KJn159dctdxG_oB-WjuNRncRcCLKxpwLnYUOOm9ngR4-vPxyd9KEk0hYlSTExVLeqogZGDNvHg80rbSApBnOM7U10SBFGnVZvSKeGtEW38ak36vIY&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsu0SGJVw_jiB89mMs9rM07Sav2arnqzX24kAYcsObAZsIvp3WJwy_hyY4mhrRdb0HiGxgTW9fw1g_1gACdVfXwwhMMDum-Yb0uL-1so95BZ7E6qkYGjZtzWx4195WIv9-FosOehK_54BeMG6GoRFqpS5-bXyEoeMseYgPOkq9C1X_x5kkB1vNZHUNTUBcJnSbHh4RYdvAYH2HtvH6xjoIkXU4bR4LJ6Sbrl2pJnKUaCHv5QeHBbkyHIwM8bNHAvWg7ELevd6w4CXRANw46mPUaM-lA6td8983PHik4rmG2B8wcimhx9RNlm_9Fo0ektH4BUvRQVSY1yAckxYhY6d0gty50F7KU8yNoPduHrq4RqlnMNDPIeocGDpfrNbUQA987_cvQ9DIc8j9_dHxsWfbEeQlDmbAaz3B7uisuXqrQrgkrQS7C7UirOkA&sig=Cg0ArKJSzNIeADa8nHJs&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.northwestmuseum.org/programs/special-events/mothers-day-home-tour/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJES80wDXaweOfxliJoxMDXkpXWpF1sPspj6XU9Pl8JrNeH0h0ypu2eYSDRrOd_ji5IeExcP7yRBLlfBWWRj5AkfnVYwfOIGMBSufjtDgcqda4kwGy05IIeb6enlUe85HAwg14Ij05K7awmW9fxcMTd-RG2gobnUzdF9XObXkQ92shgiKmDb5_7hFTIw31lfR3TEXeOmw4o2leel7vnriEPxjXX0L8B8VaXNrlHgK05suo50uH8B6MDKPW4Cqxs60GUFturQlfCLsOUmheF015lugqqDxvWob7WQ67tkJtE07OD70A18wyaayrIhT9MHxxTrb2XJZ_OMCO6WeGzBsrvMTnLGGwP-BAdBUivmfZCKYV0nStQDrAZfXq7K7gHGdvr1pTbMHtGjaXmSKtNkTZ10-dTiP-HYix4VGorNRlSfziJDE8xB1tcazSmukQ-ArCuK_psn4mrF4K-yNbSXABbUUw9hvkR1aSTxCszF_gpPblB_-rcDzJjb-nC5mZYN09EUOWVpm6n_r9lPDKfhh9WC21lFlrkrORLBg_TUNeI9xFjTDPBxb5o4A_3BxNgPnGPtFl91KGsoXs5elZJ8IXBq3AhsHj3Nqiobx0D2feDHCgijz4qyBvJ7KpDhQturxaHhauTTR0pbKLmdOnPvSFzqaliJUDkMyez9cBDxw2D7ag_2S1MHs2GTSiKLwsoB1haVkU9mM7VjCWF4_joYEh4CeidR3_HHw3ba1BHdWk9gNVJu1t857Bt8VDZWmbcefMjWwcQBWB3O04gMdzHeO5zNcuAZr-68J2OTzzogHwTNtaamd70Jol6OBXB6OMoJdm2Ahh01-Zj5bcSLgcWN6NbOeg5AItaPuAYxASCD9vazKoViLFcxTNpjRDfaoWYt0SRczUW6HNxyHiSZWoz-unUA3PSk5H2ImYmNAi2NrkoAl8sldqxO6OutqHOLcYHBc1veX5gyK3pudS9kkhDxAzl-3Q_ge9BDHmUQOZX8wkDK5NvFwl41xGj6VB3fCSVM2yKtPsN-2uuaowErTfNOe83rhuhzog6SWkLJ5HGDUgftiiII4Hu8j_oLNPQ-zORPmNRMWG0ZM7vUzrkYX_fFPFEUkwIaqjUnvoFM8p2daIh-4q9beRrB-IpH495bKGuaJbwTHODGMPuqAO8SDV78Kje0EJdRHNEQ0uhQTNunZUP630xI_zvBbayg8F95GPSK3uQMoYxgpMCg5BRXY3ql1SgW7R1ileu4fHgRhvE3_ACgHads-wvgiauCzD4160ygW01NzeYPAicBoltys643t7JI0S4ecPC21-2393LPW9wZWJ0kc3d-WmBoLOlE8ePUbRQ3EH18LPwQBkD4agVdhk_HuJC-kne6DdnX7bvVL48svgFhdbSS1bfCKKwkzv1WU0sqIzOb3CAX7_VtneksFJZE5&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsv5sSHr9FO96LUfArxft_WYtD57tcOPbz67UcrDl6A6cetm1ty313_vCKpdEB-X7G6sIFGt-9t204SgeGpvXc8jT6BRDeuL1hU9EKnfCjKluoQh4BqIl969dPGYQUfJmjOztSARafggDArQhHn6725eKJUsGFx2tDVIoCJ3kX9cksbn6Gp0QUq3bTxjyy6Bc_5rdY3bw3nlVnaEmpPf0255atfnyYF4Vo4BF6ziqp_bdlIDke8Avu1qnR4iosYxI21G21v7a48dmcI48MQ6ETpdH8WfLcT8bzoCPKFfEecTlaiB745swRxpjj93zygdtILhBByq_0xpLzSjJfMpLbPEEBNtZCfgWhd4qtrXpfBrQkVR1JdHw1h7Y2q2Ld8IdQbc5R0jcjrpJzLe6OsVQX-Yq4m90hyhX9Hr_9IcnmTY81zHvZFLdGLsGR6I&sig=Cg0ArKJSzH6PpvFoogyq&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.addressspokane.com/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJES3WkwxdiRjK2_5TXGTg4zwHD3apkLRpO3gPKDS5UlGWg8IlfIcRgaPdHf_uuTv9wgTNB7S-rSXlsnaZt4sDu7iwRyG-NOSe4rAIIcr26KCBhdPPDgsvH06Ok1Kwur2zdvM_TcrluDdtjLX03IrF-2_ZBmwdV316mpGE0aSZOa8WrRH65qWhq8HxXV36358ECwk4VpH2NoP_-zDNZw6b0mYcO9-CqaKE8ELVmrJ7Ll1arkl-_zcfcUmR4x3jNd8p6T3cF_SyY0vR64Pkyy70EYmQn92yKCGVvJpO2GDgm80mYJqwtBIBNSV41hyP4oyxVuPn5d6RrbQ1kDmJBAmjzJybPe8CooLVpem0xs03XlbWPXRCmZcC18ZBaOjOsMi_FsM7eHvNyQaaMBT_D3TDH0TBh02NbIbOgike6moUo-BCPY8WQ_ex4_Ajttt2UIbenC8l5e8FuzEgbuy0q1-scGPrKs6wZmIAlcXm24hqlu66RHeEhHf9yq4L7XI5gOa73xqgAY4bjsw2QAnwwME3Cy2fUh9thrRLxUAuIsZ0UfVlbLn9aI9bR84tVCg9orbk5k4TpX0P09WdNBqWSAoOLnJiJS9TES36Pw6Oht89Kaq10sMOV11J_N075tUZ4-4BB0OlA61-aQVTcHH3aKKPt3fb1P3Tp541JzWDXUF3hYoampu9NZj8epLXYQS0z3pEn-0-3d92FS1uOdRrN1uMFINXD4pvWOHGZuKtcqbEQr714Kri-eZc82_XP9ZMNfCPzM9WBXaw6Bl5Ic3UOM1UtPmlTdlStfHCrYVayW--Iun0TUnUvcYF-YIWargidlT56R30MWbslwDjgmMj7zjocvIv2JJS07D5u3Al5tivt5NpDYrF93EjwzIcQvyekLTFFgNbr617d0RjOKtU_BMT7rhWfnc9n9eD1ROaTA4arvEmExP_xR-a-9pZG3BLnjN4f-O-gwdxptQkIbPwZzi8lmHZblb9lV3ZTb5JSoHMukbejz5uClp6MnzEiaP2ytg4kf1PAbBPuW37lShNosHbNAxT3dhzL9CwZmoNLwMI1rhJn8w4neuxtdlgufKJpWCVqDYYEt_3Lx8LmJ26lJ-liAcn7G-aPpreokrj6ZQQ-IhHbI4L1eSeJd1Czp9aC9MAMAAlqwubRJgeJUo3sFFGW0a1PCR5-PGEob4Xlrsg1uZwQAU5n802eWADGV51o1OG6HJARe7TVunqZk8ezT-zAy2mECrezKvkEvQ-H6OC0p7bD-tK3MqP8GpLG7_EukYvoBBjeXTTSiOHYmr_uagkWBgcaCOoWBLtolTm4ZyPcLVwuuNlYQi3QYqM5aKA5kkG98ia86vw26wkMcMyN2HdsdF-iKpVxG1pM00x68Iwhhzx_S7A0hh1VWOj2ttfqeop5Vd--DhHTBtvNbfXBs-lAE&opi=122715837

Search URL Search Domain Scan URL

URL: https://pagead2.googlesyndication.com/pcs/click?xai=AKAOjsscuFiXT9h5QzpEHTvUZTkI965trQl60oq5DG-b1pE67tl6qqUTb0au4BXZGT6chNgJ_y4eDHrgACDJVSfjVotZgMZ7Xw4O--ZbBFOar4nmZRvhxjlpfWyr173d12rwrs_bzK7zlBT5BcBHbrZIm7i-P3uv_aaugYLTz2GlnIljPNElfCCBUv4WAYp_-6tKubMF20V_WHVuYkd1nw5FvDdFFB82YFF2ctlXQpL28hNF6V5TOjJpPC_9hLHZGAyygTVlkETv4qfF5m8VX2SKmLJTCfkqvVY1gfmEgJNrM1oAkN-9kZ3GZWrrfj8Hq15LXbLcTPqA568G8N663jD9JXWAp-jeKjKI2XxjlxZanakB_jSS8IM0jtqNd-heHSd-pAdFzL-tYwBQ_ZXSiXZZ7SRJKgYrtcjJ90pSui1fsL0D2-ENAB55jTr__pmr&sig=Cg0ArKJSzLcqljnWpN-B&fbs_aeid=%5Bgw_fbsaeid%5D&adurl=https://www.addressspokane.com/

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AdhHJEQFgW_OhvrepnAxJb5p6cqr64pvUOH-fuMcyd_VnCNM5Hn8_ehRy1t35BZUUZKJ-A_KeG0MCPCndYIhdWg-EJ_EtaeZ1guU4MJGZhZjgBi1Z4ZpQ1Odm1MVbj6yE6hF9Qpg27fhMk6bUofPvn6kP_rOTi71EB-IJI9Zv756xl_Js2u3TVbhHHxBUhbQDtpFK5aVri2MSI0oEWVbQsdHVDySKX0Ft8gbMrGwQY7CG-MMnz9vQ_NopC2jSvYdTyUZ4rs8pXrQVBLbQygHDKwUWP-mmnPltXP6zCS6lIZI4r7eiq0KG6yeJlvFqR5Srcw0ggl078_FrhrxEJ4nhmh9jSZEyY-7L8uKcT7PexBFVlh6c2QEN8vY6xjjZmJbxy11XowpceIqquEf0EyZSQDqdbUOIn6wOmYNQ4xcSOSPt58154VJhhaQKJSfIQLKtagmLkHLIG0LEKWuqpE2MYld98aVZ1hS42kcP1YhOgvbOYtGOTpYV7yxEd0v0cMmdqndLnALKI6JPX-HT-o8aFtPKFp-FjHWygACEmkee8uNP1swB--8TK86PftQyLWJ9jiVMor8rY7VOBXLKK-8TW9-aCWLGmvppD4KSQTCvZyp-ehT__KvaVfdQztltUj9x9f0zC0NYQV-dGplKZ-zVnZn7ujBWxN2GKLU-EYF8bDX4vzlNU3ycS5Zpij7N7IlIgwH9_k1nq_xU_dtwn4ND-5_7Sq9LexarX85SjSMWagijpx35doN9w8C7D8FB9fBRU9q1y9X55B7F8cePMWpkBij_CIGChZk1r3tC3IYF_0wGPW4IXbs7OPbRBRejG-Enb201YaBNjMuFlW8TOfqlsl0VSQPOCbFF9gqO06kVikbpF4Vm52BQNJflzGry7ku03crfkU8W7ckhvSIQuW9KB7DipFr0fl5p-BrtW4v1OXm9Ba0MBETilzSlz1WR1VrFuXxsI-EsKk9k1r50ISgHBEPsSXXWHqEZHZUWwCWxTNsgNi-9nfgEuqPp3bmEsiMbA4jvCtTtsDvo7zvCs78-cea2dTdL9gX6XlCK-lJ3zgjds5WPTSdiv78xzdYBWTF04L6bKqjvbaz1ldjAj5MI83NBKuCW5MPLRgWS2RYP_Cup0VvrewR80WFFaDvaWBUCN4sQbgRoDv0te84xa5d1kHjMVGvsVzrVo0mi4z-Wn81Iaq7buREBlTsRh9bRHKfqW6tcK-vAefOxAOzhJOE6FjudIyreKUFzGpah5vDKX2CGILI3iW_yuOwsoAkeF5u9jkD9iGa_P-GMxA2VMplWSBwGADyuHtc16qHzUuzmucpNzDOcFdUL7tDMSe2WODWKOkb5zw8EaUKinB3wPydv4CEy7aBOB2FjDvZMWQArtw3CfbVljYJsJWLeAEMlv5Lw66mMdzPINK-gT0VfUho-p_adxQ&opi=122715837

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1685 HTTP 301
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

Request Chain 80

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback&render=explicit HTTP 302
https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js

Request Chain 155

https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js

Request Chain 275

https://ads.servenobid.com/getsync?redirect=chrome%3A%2F%2Fversion%2F HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%25253A%25252F%25252Fversion%25252F

281 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/ 145 KB
40 KB 47ms
20ms Document
text/html 18.245.86.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-11.fra60.r.cloudfront.net

Software

nginx/1.28.0 /

Resource Hash

920d6ad6f88618b9536120a740d74c1523313fee1717ef5a75385da286808e8d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 9349
cache-control: max-age=18144000
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 05:19:18 GMT
referrer-policy: same-origin
server: nginx/1.28.0
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,Cookie
via: 1.1 9d1f21fface75767578955e1853e754e.cloudfront.net (CloudFront)
x-amz-cf-id: imIr_nSrDalnoKSX8iiCLOH_ghKK-kR2wC55CatdH0n0pUnQnrmKHw==
x-amz-cf-pop: FRA60-P6
x-amzn-trace-id: Root=1-68203355-0565eed33e5877ab56165780
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noarchive

GET
H2 200 sr-loader.png
thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/ 11 KB
12 KB 46ms
9ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/sr-loader.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "7b6592542ec6d8d4377eb143251c2f5b7d76aad9"
age: 18610448
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Thu, 02 Oct 2025 22:20:59 GMT
x-cache: Hit from cloudfront
content-length: 11662
x-amz-cf-id: rU59-SkTZN3FyU4U5DBW6pKwlByL1HAVlUM6OdE58Qsfko02rDrD_Q==
date: Mon, 07 Oct 2024 22:20:59 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 style.min.52136563b229.css
static.spokesman.com/sites/spokesman/css/ 748 KB
178 KB 73ms
14ms Stylesheet
text/css 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/css/style.min.52136563b229.css
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f58921ec9151a34826886c1f0cc2c18e289c5a77bae74084ca05084f298db597

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: accept-encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"52136563b2291e5e6b2b8b9cea4adbca"
age: 3484908
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: x6BAmtFcfjIaKaQrbOR7IlE0BSr6AuYPz1nipCSeKojktD-YOCtfgQ==
date: Mon, 31 Mar 2025 23:53:19 GMT
content-type: text/css
last-modified: Mon, 31 Mar 2025 23:52:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 jquery.min.12b69d0ae6c6.js Show response
static.spokesman.com/sites/spokesman/jquery/ 87 KB
31 KB 53ms
53ms Script
application/javascript 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/jquery/jquery.min.12b69d0ae6c6.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"12b69d0ae6c6f0c42942ae6da2896e84"
age: 18083503
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5FZG8uLB10waj9uSzjlzPMcZ9nBhsY37-1y-odiDJfdqr7AkHcTKcQ==
date: Mon, 14 Oct 2024 00:43:25 GMT
content-type: application/javascript
last-modified: Fri, 11 Oct 2024 00:13:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 critical.min.01e92d87dfe7.js Show response
static.spokesman.com/sites/spokesman/js/ 22 KB
7 KB 31ms
31ms Script
application/javascript 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/js/critical.min.01e92d87dfe7.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9ef22c9cf20460bbc639afd09b42f03a4e91db23bf8d774280653a7845b157de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"01e92d87dfe75f665e5b3bc2ea97feae"
age: 20346396
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: XgljVg9D4teh9go7DE-5HGUk0H2_ZXBNhD6oHSZhjzLGwMwZBHsuVg==
date: Tue, 17 Sep 2024 20:08:32 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 17:27:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 435 KB
143 KB 74ms
40ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c7067ad0a4b1fce8953045a7b24c04d26fb1dfcb095f925f8ea2c961e0a5634c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 07:55:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 145458
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 flipptag.js Show response
cdn-gateflipp.flippback.com/tag/js/ 93 KB
33 KB 147ms
108ms Script
application/javascript 13.35.58.60
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-60.fra60.r.cloudfront.net
Software: envoy /
Resource Hash: 52891b99945a4e935874efd838a240525e0b7d934ee308556f6ecc92d7553ace

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store
content-encoding: gzip
x-envoy-upstream-service-time: 3
via: 1.1 172c1df55a41f1a1b144f3711399cfc4.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: bVyclbwEgNwOw_NF40DwY68P96gAZkSQRTRPaSWfkoD5vsbtSohmTg==
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript
vary: Origin,Origin, Accept-Encoding
server: envoy
x-amz-cf-pop: FRA60-P10

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
33 KB 53ms
28ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

65e3cc7fa948d838346bf198e5142d6a06ee6a9574d3f1dd1a2b0d017a282099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 21 / 20219 / m202505060101 / config-hash: 4568831147539001230
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 11 May 2025 07:55:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33548
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK adb.4364783.min.js Show response
prod.adspsp.com/ 2 KB
2 KB 80ms
16ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.min.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8282af7cb6a3d9dacc0d3fa3d57e958b0fcc210d3acd82b2591ea7198421124

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"040b0a820fd0d7e3780d2dbe79fc8fa1"
Age: 150
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: krfByOQeBWv3r32_t2OHTXx262n9TsEowUXBCa8vVA-HaUF9I5_ZMA==
Date: Sun, 11 May 2025 07:55:07 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:01:54 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=1800
Connection: keep-alive
Via: 1.1 c8ad942d9a5a20a8da22d39de4142f78.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 base_ads.3d7203f56dfe.js Show response
static.spokesman.com/sites/spokesman/marketing/ads/data/ 4 KB
2 KB 18ms
18ms Script
application/javascript 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/base_ads.3d7203f56dfe.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a120a51667f8a7d4c6202c1ca0df9a2a458633a96f2c1c57116434887a5d3565

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"3d7203f56dfed810ab1f436853ddd579"
age: 21195469
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 1uOChXYqYRgQfMqV1UGJKnggxjkvlvRgm1fB0qK_aU-LiDoROXDDcg==
date: Sun, 08 Sep 2024 00:17:19 GMT
content-type: application/javascript
last-modified: Fri, 06 Sep 2024 20:43:04 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 day-partly-cloudy.png
static.spokesman.com/sites/spokesman/img/weather/header-icons/new/ 12 KB
12 KB 22ms
22ms Image
image/png 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.spokesman.com/sites/spokesman/img/weather/header-icons/new/day-partly-cloudy.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 103336c754fde9c2c7fc565bc5385b94409c0d5480cd8564c25f18f6cced5a85

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31536000,public
etag: "3148ca6be1dd30f49fe8c5a64b9f5781"
age: 20247484
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 12254
x-amz-cf-id: dBRC3Q_WALbAThabii03fIVoIUYpKQdi31UMSTVQvopYZPNk2265Iw==
date: Wed, 18 Sep 2024 23:37:03 GMT
content-type: image/png
last-modified: Tue, 17 Sep 2024 17:27:22 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 615357f72bff3.hires.jpg
thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 165 KB
166 KB 43ms
15ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/Mm-c9_XhjVNipKcb3RvMy909cN8=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357f72bff3.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: 02a30ea6b407de1b91903c7b846cd49cf8bd7fde84369dac046578a845b2481a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "f8ad905a26a2164c578c1054bb358a45d75b8dde"
age: 9349
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:18 GMT
x-cache: Hit from cloudfront
content-length: 169392
x-amz-cf-id: Nbz_U_YuNuaU_iB0vL9YUXXV9Hvka6EDZSTCDRzzbKune5ZOtmh26w==
date: Sun, 11 May 2025 05:19:18 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 latest.umd.cjs Show response
widgets.givebutter.com/ 464 KB
465 KB 255ms
157ms Script
text/plain 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3aa2c059437af622be6abf87d58e045c85321f5fa7a89d1a3e4c033aa4b5515

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: DYNAMIC
etag: "00bb578424f1bc3ca62fb11de89f3806"
cf-ray: 93e01cbdda94dbe3-FRA
accept-ranges: bytes
content-length: 475334
date: Sun, 11 May 2025 07:55:07 GMT
last-modified: Thu, 08 May 2025 17:53:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 300 KB
102 KB 78ms
45ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9bf67ff94214ba7bcfa5a423bcb3d46a173efae1a8d2f723b40af00385c87d99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Sun, 11 May 2025 07:55:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 103825
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 marfeel-sdk.js Show response
sdk.mrf.io/statics/ 175 KB
48 KB 320ms
290ms Script
application/javascript 104.19.220.32
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.220.32 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1768c23832bcb03d3fcdd3f6edf07a71f0c5c7b6323e50a4fa2e9276cd30800e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

content-encoding: gzip
cf-cache-status: EXPIRED
x-response-time: 206ms
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 11 May 2025 07:55:08 GMT
vary: Accept-Encoding
priority: u=1,i=?0
cache-control: max-age=1800
x-envoy-upstream-service-time: 219
cf-ray: 93e01cbd6a76dcbd-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48688
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/ 532 KB
167 KB 7ms
7ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

1dfae417465bc4ba3e518e6adee43d27c0aeee39eaf536d68ca301b0cafb1145

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16206274684016054142
age: 3470
x-content-type-options: nosniff
expires: Mon, 11 May 2026 06:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 11 May 2025 06:57:17 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 171178
x-xss-protection: 0
server: cafe

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 300 B
160 B 35ms
35ms Fetch
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

c87b1ac68fcdd87aba62be35fd55eb8888d87b6e648d88dfd35330335938b02b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:07 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 135
date: Sun, 11 May 2025 07:55:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505080101/ 64 KB
23 KB 16ms
16ms Other
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505080101/gpt

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

2f4e461046f3bb7885829e48f8dab784f2b1e65c8a115742488762af28829d41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5808547447683133843
age: 5509
x-content-type-options: nosniff
expires: Sun, 18 May 2025 06:23:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 11 May 2025 06:23:18 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23401
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505080101"

GET
H2 200 noncritical.min.e3d124e9151c.js Show response
static.spokesman.com/sites/spokesman/js/ 2 MB
564 KB 9ms
9ms Script
application/javascript 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/js/noncritical.min.e3d124e9151c.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d9f8cd6984fed9b5196dc9b4d2da9ac37226be6c94a39ee2f56073f73e22093

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

vary: accept-encoding
cache-control: max-age=31536000,public
content-encoding: gzip
etag: W/"e3d124e9151cbb7ae0023cc6af872bb7"
age: 10150030
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: duB3W4x5_Iud9SogqDv3BZy3QZqecFxisrn-JgcIzjsKX0RqUck-GQ==
date: Mon, 13 Jan 2025 20:27:58 GMT
content-type: application/javascript
last-modified: Mon, 13 Jan 2025 20:24:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

GET
H2 200 681fe3c06c09e.hires.jpg
thumb.spokesman.com/aaWKEji5bAFr5bWmZmw2sk2LWf4=/300x169/smart/media.spokesman.com/photos/2025/05/10/ 7 KB
7 KB 13ms
12ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/aaWKEji5bAFr5bWmZmw2sk2LWf4=/300x169/smart/media.spokesman.com/photos/2025/05/10/681fe3c06c09e.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: dbc4c944a2abdd71f26c31458b90ae46a60fcb5f7673cf86e155755015282c03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "efb674052f070571a33cd1186008da965dd970dc"
age: 28135
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 00:06:12 GMT
x-cache: Hit from cloudfront
content-length: 7034
x-amz-cf-id: r77liAbStfTM8p6Mp2cdu9QLxaiA8N7xOw_cvDZrccjfXtu5XrZsNg==
date: Sun, 11 May 2025 00:06:12 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 20BPL-201208-KP-51-3076.jpg
thumb.spokesman.com/HwfGOiEoud1-ndvvfOa2SwaVyGM=/300x169/smart/media.spokesman.com/photos/2023/10/20/ 12 KB
12 KB 16ms
16ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/HwfGOiEoud1-ndvvfOa2SwaVyGM=/300x169/smart/media.spokesman.com/photos/2023/10/20/20BPL-201208-KP-51-3076.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: adaf07c7701d826d9875cbb76bcb113ee13a1058ae744e4d18a10f2e4fed258c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "c53f4d961cd73db5fb6df2b819df2fc1566f1110"
age: 2651242
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Sun, 05 Apr 2026 15:27:45 GMT
x-cache: Hit from cloudfront
content-length: 12092
x-amz-cf-id: 7HLoeOOWEEMwMiSJ_spnsIHaIWyDdS7ZVqqei6P3KEMHRgI_vjFF_Q==
date: Thu, 10 Apr 2025 15:27:45 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H/1.1 200
OK adb.4364783.cr.js Show response
prod.adspsp.com/ 161 KB
58 KB 11ms
10ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.cr.js?c=Cx33bcf6f:mafk1c8u:16
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a818e9f64e6062493c2f08078990ef5529ae59638c8202c690520ae905b35f0b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"c9b555fa7ca4c1be0f50f931d22a2df6"
Age: 229857
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: nsZ3-YdNX5EgGdACpuIMpAEtkqOYbOMl9O2nB48gtQ-SeEm6w1o2kA==
Date: Thu, 08 May 2025 16:04:10 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:01:57 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Connection: keep-alive
Via: 1.1 c8ad942d9a5a20a8da22d39de4142f78.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK adb.4364783.pb.js Show response
prod.adspsp.com/ 261 KB
91 KB 26ms
13ms Script
text/javascript 13.35.58.11
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-11.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0cb1bf32539483f685b02b014d2a44009828e0345cfad31af0f082df7bac97a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: W/"9fe74500637ac1d70005f5356e05feb1"
Age: 229857
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: jeGyaZHN948KxxVGNgGcHPajUABzmKcJ5AKR_wM3ewFVZssqfE3x8w==
Date: Thu, 08 May 2025 16:04:11 GMT
Content-Type: text/javascript
Vary: accept-encoding
Last-Modified: Thu, 08 May 2025 16:02:06 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Connection: keep-alive
Via: 1.1 13c8b9a0a39ad1238a922185ad5547fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P10
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 432 KB
141 KB 42ms
41ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&cx=c&gtm=45He5571v71896582za200&tag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

aff2114e664d09888407bc8a2c3793e5554ea928fec4caffea0487b9a3332a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 07:55:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 144457
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 40ms
7ms Script
text/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 3047
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 09:04:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:04:20 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma20153/575681700/20/
Redirect Chain

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1685
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

148 KB
43 KB

9ms
8ms

Script
application/x-javascript

107.178.250.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public,max-age=3600
content-encoding: br
etag: "0033e6720ea8d009cad21d1cffea7a41"
age: 87091
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache: HIT Sun, 18 Dec 2022 07:13:38 GMT
content-length: 43903
date: Sat, 10 May 2025 07:43:36 GMT
last-modified: Fri, 05 Aug 2022 08:39:28 GMT
content-type: application/x-javascript
server: nginx
vary: Accept-Encoding

Redirect headers

cache-control: public, max-age=269200
location: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 07:55:07 GMT
x-served-by: 1-gc-euwest1-xgfw1036
server: nginx
vary: Accept-Encoding

GET
H2 200 1009641 Show response
fundingchoicesmessages.google.com/i/ 22 KB
10 KB 71ms
31ms Script
application/javascript 142.250.74.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/1009641?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.206 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f14.1e100.net

Software

ESF /

Resource Hash

864b19efbddca842373a716d23fafeb056990174c8560865bf026dd1bc1201bf

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-zMp6TbN_kI2iqA-uDUhHcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmII1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDu3XuT9caRm6y7Nt5iPQzETdq3WbuAWIiH4_b6xoNsAh8aJ59kVtJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDWw0DMwiC8wAACGgUUD"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-zMp6TbN_kI2iqA-uDUhHcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
88 KB 37ms
36ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-230256-14&cx=c&gtm=45je5571v869949972za200zb71896582&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e10bf746591a863ffe6a312abf6199f366735bb3fc50b4432c54abd2caa39a2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 07:55:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 90388
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 84ms
55ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746950107706&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&cid=366061901.1746950108&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1746950107&sct=1&seg=0&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=383
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
550 B 114ms
71ms Ping
text/plain 108.177.15.156
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-G3BY0LGVDL&cid=366061901.1746950108&gtm=45je5571v869949972za200zb71896582&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.177.15.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wr-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 51ms
32ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-G3BY0LGVDL&cid=366061901.1746950108&gtm=45je5571v869949972za200zb71896582&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&z=984576765

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 11 May 2025 07:55:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 beacons
p.flipp.com/ 0
0 382ms
183ms Fetch 34.234.209.110
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://p.flipp.com/beacons
Requested by: Host: cdn-gateflipp.flippback.com
URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.234.209.110 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-234-209-110.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer

Response headers

access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:08 GMT
x-envoy-upstream-service-time: 2
vary: Origin
server: istio-envoy
access-control-allow-credentials: true

GET
H2 451 712559.gif
idsync.rlcdn.com/ 0
98 B 61ms
19ms Image
text/plain 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/712559.gif?partner_uid=1f407198-fb3e-45c2-8ea5-dbcd42174928
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 07:55:08 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
454 B 18ms
16ms XHR
text/plain 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=366441399&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=de-de&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACACI~&jid=1553450497&gjid=1976551610&cid=366061901.1746950108&tid=UA-230256-14&_gid=2142407574.1746950108&_slc=1&gtm=45He5571n715P9SH6v71896582za200&cd1=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&cd2=nation-world&cd5=2021-09-28&cd7=News&cd8=979335&cd9=story&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&npa=1&z=522301563

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
393 B 63ms
62ms XHR
text/plain 108.177.15.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-230256-14&cid=366061901.1746950108&jid=1553450497&gjid=1976551610&_gid=2142407574.1746950108&npa=1&_u=YCDAiEABBAAAAGACIAC~&z=26735873

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgdc:149:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:07 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgdc:149:0
content-length: 1
server: Golfe2

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 18ms
17ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972z871896582za200zb71896582&_p=1746950107706&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&cid=366061901.1746950108&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAACAAQ&_s=2&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746950107&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&en=page_view&ep.author=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&ep.primary_category=nation-world&ep.publish_datetime=2021-09-28&epn.object_id=979335&ep.content_type=story&_et=2&tfd=461
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:08 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 615357f90db28.hires.jpg
thumb.spokesman.com/tkpMXt58RPPtXb06qhV9GQYtTuA=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 137 KB
137 KB 13ms
13ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/tkpMXt58RPPtXb06qhV9GQYtTuA=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357f90db28.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: 992c3b7f9e36464e9e12189dc404c5c781bcfbc7d65d0a1d9398b30d4b33913d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "b100697c5dac621559ab2422a8a4c110fc60e75a"
age: 9349
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:19 GMT
x-cache: Hit from cloudfront
content-length: 139906
x-amz-cf-id: HX5aeMlyQXrx994LhJWXzNlfFS6QEVBtyQu0jGWIJ1WKiCO20xAQdw==
date: Sun, 11 May 2025 05:19:19 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 615357fadba2f.hires.jpg
thumb.spokesman.com/Lwy5WX6YEbFfh5Dc51CHBN0OtNU=/1200x800/smart/media.spokesman.com/photos/2021/09/28/ 136 KB
136 KB 17ms
17ms Image
image/webp 52.222.236.85
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://thumb.spokesman.com/Lwy5WX6YEbFfh5Dc51CHBN0OtNU=/1200x800/smart/media.spokesman.com/photos/2021/09/28/615357fadba2f.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-85.fra56.r.cloudfront.net
Software: Thumbor/6.7.5 /
Resource Hash: ca0ba71b383a70dfd62c73bd1676f387fc57f5dff42c2b805f5ab594114bce52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31104000,public
etag: "d181542597a4422fa63519862702a4457a9621dd"
age: 9349
via: 1.1 30e954298424aa69c035e25834574742.cloudfront.net (CloudFront)
expires: Wed, 06 May 2026 05:19:19 GMT
x-cache: Hit from cloudfront
content-length: 138944
x-amz-cf-id: iv8fOsv5QxqBv3FDJGTeaF8iPGs4RBs3buBYzDc8krWusHw2xfNbog==
date: Sun, 11 May 2025 05:19:19 GMT
content-type: image/webp
vary: Accept
server: Thumbor/6.7.5
x-amz-cf-pop: FRA56-P4

GET
H2 200 loader.min.js Show response
cdn.wgchrrammzv.com/prod/spokesman/ 38 KB
14 KB 156ms
40ms Script
application/javascript 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sites/spokesman/js/noncritical.min.e3d124e9151c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 563f81beb3f77223df0b04738213c7b911d686c367c85850ef4ca5245aabd087

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-cache-info: L1_T2
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 46
x-cache: TCP_REMOTE_HIT
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Mon, 13 Jan 2025 06:51:56 GMT
cache-control: max-age=43200
x-ms-request-id: a7565d88-701e-0059-5106-c0703d000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T075508Z-15f677d574b44dq5hC1FRA7wt000000005hg00000000qs0s

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 489ms
180ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&artid=979335&artpubt=1632852480&artsrc=Associated%20Press&arttype=metered&artupt=1632887331&auth=Maria%20Cheng%7CAl-Hadji%20Kudra%20Maliro&hier=News%7CNation%7CWorld&ptype=story&prem=metered&pubname=The%20Spokesman-Review&sec=News&wrdcnt=927&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=fa04b2fa-91e5-4a58-a2e5-b896c47c0ede&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950108077&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=1600x4842&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTc0Njk1MDEwNzU1MCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMG1iIiwiaGVhcFQiOiIxMG1iIiwiZnN0UGFpbnQiOiIyMzYiLCJmZXRjaFMiOiIwIiwiZG9tYWluUyI6IjEiLCJkb21haW5FIjoiOSIsImNvbm5TIjoiOSIsImNvbm5FIjoiMjgiLCJzc2xTIjoiMTUiLCJyZXF1UyI6IjI4IiwicmVzcFMiOiI0NyIsInJlc3BFIjoiNTMiLCJkb21Mb2FkIjoiNTEiLCJkb21JbnRlciI6IjIwMiIsImRvbUxvYWRTIjoiMjQzIiwiZG9tTG9hZEUiOiIyNDMifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiIzNjYwNjE5MDEiLCJyZWZUaW1lIjoiMTc0Njk1MDEwODA3NyJ9XSwiY2F0ZWdvcnkiOnsiY2F0ZWdvcmllcyI6W1siTmF0aW9uL1dvcmxkIiwiV29ybGQiXV19fQ
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:08 GMT
Content-Type: image/gif
Connection: keep-alive

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
24 B 28ms
27ms XHR
text/plain 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=366441399&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=de-de&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACUABBAAAAGACIAC~&jid=2016783717&gjid=1435635900&cid=366061901.1746950108&tid=UA-230256-14&_gid=2142407574.1746950108&_r=1&gtm=457e5571z8869949972za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509156~103101750~103101752~103116025~103130498~103130500~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=615085925

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:08 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 18ms
17ms Image
image/gif 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=366441399&t=event&_s=2&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=de-de&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Preferences&ea=color_scheme&el=system&_u=aCDACUABBAAAAGACIAC~&jid=&gjid=&cid=366061901.1746950108&tid=UA-230256-14&_gid=2142407574.1746950108&gtm=457e5571za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509156~103101750~103101752~103116025~103130498~103130500~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=39999599

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 30827
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 23:21:21 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 18ms
18ms Image
image/gif 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=366441399&t=event&_s=3&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=de-de&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Preferences&ea=system_color_scheme&el=light&_u=aCDACUABBAAAAGACIAC~&jid=&gjid=&cid=366061901.1746950108&tid=UA-230256-14&_gid=2142407574.1746950108&gtm=457e5571za200zb869949972&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509156~103101750~103101752~103116025~103130498~103130500~103200001~103233424~103251618~103251620~103284320~103284322~103301114~103301116&jsscut=1&npa=1&z=86809554

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 30827
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 23:21:21 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H2 204 ping
givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/ 0
0 403ms
370ms Fetch 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/ping

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 07:55:08 GMT
vary: Origin, Accept-Encoding
x-server: prod-app-i-0f400e3c74f1e3128
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=57891, must-revalidate, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93e01cc00893d346-FRA
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
access-control-allow-origin: https://www.spokesman.com
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H2 200 p57vbL Show response
givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/elements/ 228 B
588 B 429ms
399ms Fetch
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v2/zN1p7WO2gDzLLkGa/elements/p57vbL

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff29561d28196b2e6106ed73de445b309a6b3d29c61b275ac06bea071b2d9095

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 07:54:54 GMT
vary: Accept-Encoding, Origin
x-server: prod-app-i-03c8969fda49a2867
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=60, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93e01cc0088fd346-FRA
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
access-control-allow-origin: https://www.spokesman.com
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H2 200 news.e45f173b1c36.json Show response
static.spokesman.com/sites/spokesman/marketing/ads/data/ 3 KB
848 B 71ms
52ms XHR
application/json 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/news.e45f173b1c36.json
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sites/spokesman/marketing/ads/data/base_ads.3d7203f56dfe.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 23dd2a9d31ac5ee27bc8d601812cb813b3f986f704c73cd74242691221021ecd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"e45f173b1c36bf035e1b1c757e4b268a"
age: 20162228
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: 8KkO5JI_bgPQYe0VHtCh-_IU47BSBeNIBhKlyl19OmEKdLfF722g9A==
date: Thu, 19 Sep 2024 23:18:01 GMT
content-type: application/json
vary: Accept-Encoding,Origin
last-modified: Tue, 17 Sep 2024 17:27:28 GMT
cache-control: max-age=31536000,public
access-control-allow-credentials: true
via: 1.1 004e894746bfb0d8f9e19ef0400dda24.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-amz-cf-pop: FRA56-P10
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 165 B
783 B 89ms
57ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 459ad44dd647d3544551e4ab7848cbfdd29799adac87a8a7e9767acb66e8fa79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
content-encoding: gzip
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01cc02f04d25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 120
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
vary: accept-encoding
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H2 200 rfv.php Show response
events.newsroom.bi/data/ 27 B
105 B 26ms
25ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/data/rfv.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79df73fd1377483384f7b7565e98c4a430889f0388db05634271f9f302faeac7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
content-encoding: gzip
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01cc08fb4d25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 42
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
vary: accept-encoding
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H2 200 recirculation.php Show response
events.newsroom.bi/recirculation/ 12 B
139 B 71ms
70ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/recirculation/recirculation.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01cc08fb8d25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 12
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
177 B 136ms
50ms Fetch 163.5.194.36
SECUREDSERVERS-EU...

General

Check archive.org

Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 163.5.194.36 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, private, must-revalidate
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:08 GMT
x-envoy-upstream-service-time: 29
vary: origin, accept-encoding, Accept-Encoding
server: envoy
access-control-allow-credentials: true

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 474 B
795 B 121ms
56ms Fetch
application/json 64.158.223.146
VCLK-EU-SE Conver...

General

Check archive.org

Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.158.223.146 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE Conversant LLC, US),
Reverse DNS: ams02-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 63a23d48c43ca0a5b222f254b40a76115629a44af82e790c6ec2e92795240b20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.spokesman.com
content-length: 474
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: nginx

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
281 B 305ms
98ms Fetch 143.244.200.230
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.200.230 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 07:55:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 358ms
151ms Fetch 143.244.200.230
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.200.230 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 07:55:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 350ms
144ms Fetch 143.244.200.230
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.200.230 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 07:55:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
17 B 384ms
177ms Fetch 143.244.200.230
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.200.230 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 07:55:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 83 B
472 B 201ms
80ms Fetch
application/json 34.247.115.141
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.247.115.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-115-141.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: cc98b1044edf4051dbca3cf94f5974274b464e16b8e32e4af9c2e89b0b2d9673

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.spokesman.com
content-length: 108
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
584 B 78ms
51ms Fetch
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 149.88.19.250; 149.88.19.250; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
an-x-request-uuid: d2519f82-981e-40be-ae7e-0b1ce4e0a562
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 11 May 2025 07:55:08 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
495 B 112ms
58ms Fetch 178.250.1.38
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.26.0&cb=71944026224&lsavail=1&networkId=12005

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.38 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:07 GMT
vary: Origin
server: Kestrel

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 391ms
315ms Fetch
application/json 89.149.193.80
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.193.80 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 1822ms
1746ms Fetch
application/json 89.149.193.80
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.193.80 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 222ms
145ms Fetch
application/json 89.149.193.80
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.193.80 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
442 B 175ms
97ms Fetch
application/json 89.149.193.80
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.193.80 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 07:55:07 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
629 B 95ms
67ms Fetch
application/json 52.222.136.19
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.136.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-136-19.fra50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 0d4f69207ae904a2f73c54879516db74b495a4255a77b3b53072cf335123004a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 7
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 f353b9615396320dcfec689a26cf519e.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: yjOLl4fP_9A_mkJBag5zKJIkw2QQYnBnfoZJuflrnAyRYf1aldxclw==
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
x-amz-cf-pop: FRA50-P2
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 adreq Show response
ads.servenobid.com/ 549 B
721 B 110ms
63ms Fetch
application/json 143.244.197.139
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL

https://ads.servenobid.com/adreq?cb=1258

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

143.244.197.139 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Resource Hash

bde73fd53f3fe3f006b2ccad0e21b7c38c1e994301329f33f4c685323c49dd71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
access-control-allow-credentials: true
amp-access-control-allow-source-origin: *
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
vary: accept-encoding

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 124ms
95ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU57RW71
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 1fd8651da4452b29620b594e1f0e28509bdbf93079e85a95d54297740603d7ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 79
access-control-allow-credentials: true
via: 1.1 google
expires: Sun, 11 May 2025 07:55:08 GMT
access-control-allow-origin: https://www.spokesman.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 552
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 718 B
685 B 162ms
119ms Fetch
application/json 34.1.1.166
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageReferrer=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&CanonicalUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.1.1.166 Paris, France, ASN15169 (GOOGLE, US),
Reverse DNS: 166.1.1.34.bc.googleusercontent.com
Software: fasthttp /
Resource Hash: 162771d52a1d4860c270cede556d0088620b7454fd4bd59e0eae9dc740403e09

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-max-age: 3600
content-encoding: gzip
x-kong-request-id: 608a8a78bc01db7bc096711bdb5a390c
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS, POST
via: kong/3.6.1
x-kong-upstream-latency: 102
access-control-allow-origin: https://www.spokesman.com
content-length: 287
date: Sun, 11 May 2025 07:55:07 GMT
x-kong-proxy-latency: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: fasthttp
access-control-allow-headers: Accept-Encoding, Content-Type

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
124 B 108ms
54ms Fetch 3.72.6.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.6.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 108ms
54ms Fetch 3.72.6.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.6.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 106ms
52ms Fetch 3.72.6.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.6.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
123 B 106ms
53ms Fetch 3.72.6.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.6.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

GET
H2 200 loader-config.json Show response
cdn.q0losid.com/prod/spokesman/ 3 KB
1 KB 112ms
47ms Fetch
application/json 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.q0losid.com/prod/spokesman/loader-config.json
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e0c3c1e9d6b575fee5fe7cfd2fc0c8731747221e25d451a23138b92d2b7d0d88

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-cache-info: L1_T2
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 46
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
vary: Accept-Encoding
last-modified: Mon, 13 Jan 2025 07:01:59 GMT
cache-control: max-age=43200
x-ms-request-id: 2c48bdf9-201e-0009-2f9f-c0b26d000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T075508Z-15f677d574bh4g5khC1FRAkg9s000000062g00000000ps12

GET
H2 200 support-local-journalism Show response
givebutter.com/embed/c/ Frame E2AE 13 KB
7 KB 548ms
526ms Document
text/html 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Requested by

Host: widgets.givebutter.com
URL: https://widgets.givebutter.com/latest.umd.cjs?acct=zN1p7WO2gDzLLkGa&p=other

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3b0141ea859572c13c726fdcbfe59613dca592d844df273f45b22b8f5007a80

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 93e01cc2bc952bb2-FRA
content-encoding: gzip
content-security-policy: base-uri 'self'
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=q9Gzgf7hoLVBQm4yZr_UBq_etJNr.b8.1dOH2qKU.0s-1746950109-1.0.1.1-onyWgSZ1e3HMac7fKUijZ2Ekzhr2.sgHaFzy5TAp_8CGGv3t_QwcQ68fY8A_q0Gt.Xi7so8RVBOzJwEUKk1HTOspaGNxnX9w63J6VYsfWVc5niboYQbbVwAqjQ5PaT5CL67WHDAavHpizQdKOMWK.g; report-to cf-csp-endpoint
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 07:55:09 GMT
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=q9Gzgf7hoLVBQm4yZr_UBq_etJNr.b8.1dOH2qKU.0s-1746950109-1.0.1.1-onyWgSZ1e3HMac7fKUijZ2Ekzhr2.sgHaFzy5TAp_8CGGv3t_QwcQ68fY8A_q0Gt.Xi7so8RVBOzJwEUKk1HTOspaGNxnX9w63J6VYsfWVc5niboYQbbVwAqjQ5PaT5CL67WHDAavHpizQdKOMWK.g"}],"group":"cf-csp-endpoint","max_age":86400}
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=31536000
vary: Accept-Encoding, Origin
x-content-type-options: nosniff nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-server: prod-app-i-0f1be8e2fcf5493a5
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 Givebutter_H_Text.svg
givebutter.com/assets/brand/givebutter/Powered/ 15 KB
6 KB 57ms
32ms Image
image/svg+xml 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://givebutter.com/assets/brand/givebutter/Powered/Givebutter_H_Text.svg

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87b010edc18752647dcd8749bfe9abea7cb1eaf4f3ea4de0898b3ed325b1ed08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6025-3cb3"
age: 5070
x-content-type-options: nosniff
cf-ray: 93e01cc2bd86d38a-FRA
date: Sun, 11 May 2025 07:55:08 GMT
x-xss-protection: 1; mode=block
content-type: image/svg+xml
last-modified: Fri, 09 May 2025 20:05:57 GMT
vary: Accept-Encoding
x-server: prod-app-i-0441c0725a3a7c356

POST
H2 200 recirculation.php Show response
events.newsroom.bi/recirculation/ 12 B
76 B 25ms
23ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/recirculation/recirculation.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01cc2dc7ad25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 12
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
28 KB 68ms
13ms Script
application/x-javascript 13.107.246.60
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-lastmodified,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/x-javascript
vary: Accept-Encoding
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
cache-control: public, max-age=1800
x-ms-meta-lastmodified: 2020-10-01 19:31:04
x-ms-request-id: 3c0dc90e-801e-0007-5bef-bcacbc000000
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T075508Z-15f677d574b2qp9thC1FRA5qps00000005yg0000000054z0

GET
H2 200 fp.min.js Show response
cdn.a3kvau184uea.com/prod/spokesman/ 66 KB
27 KB 149ms
26ms Script
text/javascript 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.a3kvau184uea.com/prod/spokesman/fp.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a2fdfed84c31fff7b05803b3c1dc59a65956e4f0b1dbf13ce4b2340caa621c2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

x-azure-ref: 20250511T075508Z-15f677d574bt8swdhC1FRA1cec000000059g00000000xcag
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 16
x-ms-request-id: c0ca2931-d01e-006f-7206-c0fd4d000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:08 GMT
x-ms-blob-type: BlockBlob
content-type: text/javascript
vary: Accept-Encoding
last-modified: Wed, 26 Mar 2025 06:56:55 GMT

GET
H2 200 g2i.min.js Show response
cdn.sy57d8wi.com/prod/spokesman/ 225 KB
226 KB 174ms
17ms Script
text/plain 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.sy57d8wi.com/prod/spokesman/g2i.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 2f219207f3d6a30452c637cb2c1e1d2ffaf4852a0d55acf36ade1a47cf729640

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

cache-control: max-age=43200
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DD6C275F995574
x-fd-int-roxy-purgeid: 18
x-ms-request-id: 17e4c559-f01e-00b3-0306-c05713000000
accept-ranges: bytes
access-control-allow-origin: *
x-cache: TCP_HIT
content-length: 230422
date: Sun, 11 May 2025 07:55:08 GMT
last-modified: Wed, 26 Mar 2025 05:30:51 GMT
x-ms-blob-type: BlockBlob
x-azure-ref: 20250511T075508Z-15f677d574bcmxb7hC1FRAf4xg00000004n000000000sqdq

GET
H2 200 t8y9347t.min.js Show response
cdn.e3fbosf1tz3d.xyz/prod/spokesman/ 1 MB
493 KB 95ms
15ms Script
application/javascript 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 15ff29496ac40d398a774a309adfc1777340b666b3d00474a368da343bf266d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

x-ms-blob-type: BlockBlob
cache-control: max-age=604800
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-azure-ref: 20250511T075508Z-15f677d574bgd28whC1FRAkhu8000000055000000000cev2
x-fd-int-roxy-purgeid: 75
content-encoding: br
x-ms-request-id: 9030e23f-801e-004d-3eb6-c03852000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:08 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 29 Apr 2025 11:02:00 GMT

GET
H2 200 t8y9347t.min.css
cdn.e3fbosf1tz3d.xyz/prod/spokesman/ 398 KB
72 KB 106ms
17ms Stylesheet
text/css 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.css?2025411
Requested by: Host: cdn.wgchrrammzv.com
URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 7a471672f3f91ad82285192cae07b7e06f4b2baddec73d8e6898a1a445f5d0ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-type: BlockBlob
cache-control: max-age=43200
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-azure-ref: 20250511T075508Z-15f677d574bcmxb7hC1FRAf4xg00000004sg000000003ysf
x-fd-int-roxy-purgeid: 75
content-encoding: br
x-ms-request-id: 17ead650-601e-00a1-74fb-bf2cc3000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:08 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Tue, 29 Apr 2025 11:01:25 GMT

GET
H3 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 567 B
993 B 225ms
205ms XHR
application/json 104.26.5.15
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1746950108888
Requested by: Host: cdn.a3kvau184uea.com
URL: https://cdn.a3kvau184uea.com/prod/spokesman/fp.min.js?2025411
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.5.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bff1c96ca3f6b21f3ced9e31535b931d3ea0ae42efb49fb529c9aa8c98ea9bf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

server: cloudflare
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pyv%2FOUJnvTtdA3l8Yq%2B0Z6JrZQpNoRYlIXnEIcXvGL7nRQjY9Xr2FYWQHYSdXYvXiGO%2BLLk4B1TsTV%2FBw4a7qPgRabVK%2B7dTxii1oPB1uQUbZ252%2FmGXdYxHYg6Q37a4zK4"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc4b823d34c-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6269&min_rtt=6011&rtt_var=1108&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4260&recv_bytes=4434&delivery_rate=896&cwnd=12000&unsent_bytes=0&cid=ee7c2943d0259523&ts=207&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 07:55:09 GMT
vary: Accept-Encoding
priority: u=1,i

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame E2AE 251 KB
91 KB 68ms
38ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-75318216-1

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1e32a373b9c4d358c5a47f1f5b2b6c5cedf0d8bdfae37e273be811615cc83862

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sun, 11 May 2025 07:55:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 92041
x-xss-protection: 0
server: Google Tag Manager

GET
H3

200

api.js Show response
challenges.cloudflare.com/turnstile/v0/b/701fd2559006/ Frame E2AE
Redirect Chain

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback&render=explicit
https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js

47 KB
16 KB

19ms
19ms

Script
application/javascript

104.18.94.41
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H3
Server: 104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: caa976b62fb6b8808a12c08ee3434d1b41d614d404674fd4a3fd7c0528c923f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

server: cloudflare
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding: br
cross-origin-resource-policy: cross-origin
cf-ray: 93e01cc67eca45e1-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 05 May 2025 16:10:46 GMT
vary: Accept-Encoding
priority: u=3,i=?0

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location: /turnstile/v0/b/701fd2559006/api.js
cross-origin-resource-policy: cross-origin
cf-ray: 93e01cc65e8e45e1-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Sun, 11 May 2025 07:55:09 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 main.DDE89l1r.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 96 KB
17 KB 79ms
32ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9ebb8350799ffcdbd1143898dddc93a350fe53e2d790773a2510f9618966753

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"4e503fda0e211f240cc5a4f2e2634f27"
age: 2209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xOGFUGMGI0XK55daoJAZWfT%2Fj1RxmMxZ9guOwGVrFcnKa2RplE%2Fx8hl0zx3ZBf2SQ51hCe3ac5BejhwB%2BBzlkiXSOR9TLnBswmiLAq0q9YtsmZ0OrJH0OabWflPv%2BOVE2Oj5"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa42bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=26&recv=13&lost=0&retrans=0&sent_bytes=18216&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=35&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Wed, 07 May 2025 23:01:53 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 commonv2.ClJS35ba.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 8 KB
3 KB 82ms
35ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/commonv2.ClJS35ba.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67d0bdfdfd7aeda525143a544eae4164b01310d19d62149cd5d37304f0b42e51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5d920c4d4a05814c93fba318b55653f8"
age: 2795
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u2HEAsqKUwxa1BtTVgYo8PbJhZV1YfX6B8d9YX6vy8ejoc%2BbDfGFmFp%2B0gQRcIqM7J1bVVYuwtiUwyXWyKQiByhsEnnpOiHsUHZDcj35CWoNyVF4dUCHgvI5iN3rqZRJfmxF"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa52bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=48&recv=13&lost=0&retrans=0&sent_bytes=41152&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=37&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Wed, 30 Apr 2025 16:56:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 form.DsAxL8V8.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 2 KB
1 KB 76ms
30ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/form.DsAxL8V8.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00c99b5a5a184a82850f69d54e2b4fc68135b6fd3da3c9797033c50570a72c18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"4a73e33667a15fd3820a7fec1f7d9902"
age: 1165
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4Lsy8QzlxIMBrq4CuzyxJr4QPdKB3gPqCLnyKLQbIThw1q4e4qQjBRIePDFC0wDIRNNKZA9Opu4qgUtupTqbMqqEvAVqGyyK1du8SSGma1AJyvLDAm5pyObRkuLOj6YWObO"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fad2bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=23&recv=13&lost=0&retrans=0&sent_bytes=16708&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=34&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Sat, 03 May 2025 01:03:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ Frame E2AE 558 KB
156 KB 81ms
52ms Script
text/javascript 142.250.185.74
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

8a4d006fa66a00b55ff8e3d07754dd803cc52efb31f9714870ba604c93a4c0c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: public, max-age=1800, stale-while-revalidate=10800
timing-allow-origin: *
content-encoding: gzip
etag: b6a2ea83
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 159376
date: Sun, 11 May 2025 07:55:09 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
vary: Accept-Language, Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H2 200 c37fafd8d9.js Show response
kit.fontawesome.com/ Frame E2AE 16 KB
6 KB 51ms
20ms Script
text/javascript 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://kit.fontawesome.com/c37fafd8d9.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05f8e18ff6cfd0f6301a221842c6b541261607caa65edbb1d93c69d3f5001e2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

access-control-max-age: 3000
x-request-id: GDYqdPstzEF9NJzyNuvC
cache-control: max-age=60, public, stale-while-revalidate=30
content-encoding: gzip
cf-cache-status: HIT
age: 48
access-control-allow-methods: GET, OPTIONS
cf-ray: 93e01cc6fee1078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/javascript
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
server: cloudflare
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token

GET
H2 200 latest.js Show response
js.givebutter.com/elements/ Frame E2AE 192 KB
53 KB 137ms
123ms Script
text/javascript 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js.givebutter.com/elements/latest.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb128d11873821d66616bc81a3229f7b664483472e52213dc15e39e5716d6dcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

x-amz-id-2: Ni3ET2agTEyRsiI9cpSQXtt09YDyMgkWTCYHjbpBhLrE92HnNyLvcixcmTIfkSNnW8PvZcxDvq4=
cache-control: max-age=60
content-encoding: gzip
cf-cache-status: HIT
etag: W/"333ffe903e9eccafc61523aea47190a9"
x-amz-request-id: JYFMTXQFZB2F7QT7
cf-ray: 93e01cc6de8d2bb2-FRA
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/javascript
last-modified: Wed, 28 Jun 2023 20:29:40 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame E2AE 3 KB
2 KB 16ms
7ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

707e3e8cf365a9b00090d96e3964b191e83ca2c484d1fee66e84be4b92bb0bb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

content-md5: 7lRo3nCMFWHCUk8pCt+nDQ==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "df0936a3b0e53fad72e5263a57827a9b"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:12:33 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: b8aae32990350ffb8e4fccc7a7e33e72
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=23, mss=1232, tbw=4814, tp=9, tpl=0, uplat=0, ullat=-1
x-fb-debug: BCvq5c2d0mgGSrT7RSd1eONdKLyRWeue1EPAbPxrL9TtvUFutWk0dATeCtLwqUNT/z71D67MI+cvIl2HXPrznA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1688
origin-agent-cluster: ?1

GET
H2 200 / Show response
js.stripe.com/v3/ Frame E2AE 740 KB
176 KB 53ms
8ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

19abc0bf04517d277a8159f6df85d62bdaae81c51e9c9b4f4392202ddee40b05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

x-request-id: 055a85f8-02ba-4523-b4f9-6a546fbc5910
content-encoding: br
etag: "99ec8c39e4284db6d3d699207cc77c36"
age: 7
x-content-type-options: nosniff
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT
date: Sun, 11 May 2025 07:55:09 GMT
last-modified: Sat, 10 May 2025 01:45:24 GMT
content-type: text/javascript; charset=utf-8
x-served-by: cache-fra-etou8220054-FRA
x-cache-hits: 5
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=60
timing-allow-origin: *
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 179559
server: Fastly

GET
H2 200 link-initialize.js Show response
cdn.plaid.com/link/v2/stable/ Frame E2AE 157 KB
44 KB 270ms
34ms Script
text/javascript 13.33.187.112
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.plaid.com/link/v2/stable/link-initialize.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-187-112.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6effd8b04358306dbc5dd017fa15e822ebe2ab13ca09489b6abccafe40287789

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
x-amz-version-id: YuyGl9Rkq4TbskCR9kK716nqoK9UkKbt
etag: W/"525aea0aa1563984291616279622819e"
age: 9304
x-cache: Hit from cloudfront
x-amz-cf-id: vO9CqSSEjIalmudTDQtdULUHgx78uzjGVKHZcu_b0jwJsvZoS1VI5Q==
date: Sun, 11 May 2025 05:25:26 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Fri, 09 May 2025 23:01:03 GMT
x-amz-id-2: w2v0lXXBLf0mS2oBrKkUiloXSovCU+wd5KwmoqTHIvhQIlrhZI4J4dcAnxGQ1jcCAzQ07lWByCDfns1rRsecxA1J2LwV1bR3rGanPWtopL4=
x-amz-replication-status: COMPLETED
cache-control: no-cache,must-revalidate,max-age=0
via: 1.1 6ee264f4aa2ef518b13a5a8305e8080e.cloudfront.net (CloudFront)
x-amz-request-id: FDFZZVSKWBX70JWA
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 client.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame E2AE 38 KB
11 KB 60ms
15ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/client.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

851d3d9028e7f9b70c04b2e1a1c32b99e68f59395c95cc0e691cb1bb2fa7d4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: cdfac6ece3982
content-encoding: br
etag: W/"6633f9a1-96d0"
x-content-type-options: nosniff
traceparent: 00-0000000000000000000cdfac6ece3982-d3972a467a835c03-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc1000105-SJC, cache-fra-etou8220119-FRA
x-cache-hits: 2, 3816
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746950109.202038,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11302

GET
H2 200 paypal-checkout.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame E2AE 58 KB
15 KB 60ms
14ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/paypal-checkout.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

478eb7d52d6939db24f8e7bec9738452f26be903f33d085272fe96aded025c9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: 55c9b77adc851
content-encoding: br
etag: W/"6633f9a1-e94d"
x-content-type-options: nosniff
traceparent: 00-000000000000000000055c9b77adc851-3d6d972af9d937c4-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10065-SJC, cache-fra-etou8220119-FRA
x-cache-hits: 22, 3660
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746950109.202212,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15279

GET
H2 200 venmo.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame E2AE 84 KB
21 KB 54ms
9ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/venmo.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4fda72116dacabbed70d130340385957ac9da610a6fb1938f4433ee40e47bdc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: a6c7b5c593cad
content-encoding: br
etag: W/"6633f9a1-14fcd"
x-content-type-options: nosniff
traceparent: 00-0000000000000000000a6c7b5c593cad-0da4f20fe6e8600f-01
dc: ccg11-origin-www-1.paypal.com
x-cache: HIT, HIT
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10056-SJC, cache-fra-etou8220119-FRA
x-cache-hits: 24, 2
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746950109.201335,VS0,VE1
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 21415

GET
H2 200 data-collector.min.js Show response
js.braintreegateway.com/web/3.102.0/js/ Frame E2AE 29 KB
10 KB 53ms
8ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.braintreegateway.com/web/3.102.0/js/data-collector.min.js

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a761989d03c3bc3c4f54e5b249fa4616c9ef6a3bac072d02789f69d44b2db102

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

paypal-debug-id: 6ebdcfe6fe1bf
content-encoding: br
etag: W/"6633f9a1-754a"
x-content-type-options: nosniff
traceparent: 00-00000000000000000006ebdcfe6fe1bf-69cb92f2a92a66eb-01
dc: ccg11-origin-www-1.paypal.com
x-cache: MISS, HIT
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript
last-modified: Thu, 02 May 2024 20:37:53 GMT
x-served-by: cache-sjc10065-SJC, cache-fra-etou8220119-FRA
x-cache-hits: 0, 3685
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=31557600
cache-control: s-maxage=31536000, public,max-age=3600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
x-timer: S1746950109.201930,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9900

GET
H2 200 Flow.jfKK7Jd7.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 7 KB
2 KB 80ms
34ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Flow.jfKK7Jd7.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e36eef9fe41a6a81c62d8cadddeb7ef0c904dfc0fa1b6deff3314ef610f45a0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"281236cc0bbc2ccb98ef6419121334d9"
age: 2795
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=boYny3JKT3%2FqUR9wTOb6uO7%2B4GE8Wm9CctEhTyWdnM7ZKYfjmFT5oaVsMlIrRK55iyVv5ba8WUVol0K6NVRPQ2VdM384CPCtlEgBjjfaC%2F6d4rqi31xkpXYIphCNUuVOP1O0"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa72bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=40&recv=13&lost=0&retrans=0&sent_bytes=35722&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=36&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Wed, 30 Apr 2025 16:57:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 globe@2x.BMLb_Dmm.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 18 KB
4 KB 75ms
29ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/globe@2x.BMLb_Dmm.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eea91a5722b6b36943fa218f20242fdb98bf41a350e75204765b2f843164ad25

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"316375b2b5ae6dfa093e9fde79fd777c"
age: 6844
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Me14lbT9f8VGOWJoNYL5x96%2BbyJXAIGA5nybGnuWPu%2Ffg2kS06tEYB4UrrHOuvsT%2F%2B744bSJduMPci%2FBJrqn79v3Rw0nyWjNX6Xu5oOcTduBnh%2FhZ%2BIgQo8zM6JIuBPUWmoa"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa12bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=18&recv=13&lost=0&retrans=0&sent_bytes=12249&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=34&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Mon, 14 Apr 2025 14:20:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 LabeledPhoneInput.BWfWM5bO.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 17 KB
4 KB 74ms
28ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LabeledPhoneInput.BWfWM5bO.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3dda5d66b2884ca37dda8bbfe1e77a3d088f181d068aa17cdf0d2f21ca9765cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"abe87c41727630353290b705e0c0d299"
age: 5966
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4d1oULM6Vy6NMRAYD%2BjLD5kOStluMXUntWo3IsBtwZRFIj%2BaK1JeiFyR8AxI3r8%2Fe8RcE8wKN%2F%2BEqJF7N9u6zYed2ioxD6fXInDeNdFjxoMZmg3UwOl2lQIPcORTPbGP%2BF4Z"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa32bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1067&min_rtt=712&rtt_var=709&sent=13&recv=12&lost=0&retrans=0&sent_bytes=7733&recv_bytes=3054&delivery_rate=5823056&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=34&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Thu, 17 Apr 2025 22:10:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 PaymentAccordion.BzkDk5MU.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 163 B
938 B 73ms
27ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/PaymentAccordion.BzkDk5MU.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c24a1ab5a36b5ab1827da8c3fa51348be759febeaf3c67fbf46946cd08e0a4aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"45cf7dae05dbdf57f6e01685ce00a242"
age: 118
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pQUOnQ4usYjAnSc7s5xCToAOeK9WvncFQlXSbUaS0Uv2HIZQ5Q8n4gw9z6uT0dpmrqgh%2FXMU1JEq4kRivOUDPRx9mHTdqdrtTenfz1NjlDFwn5PjfSvAxad%2FryRBTIHgSyvM"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa02bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1161&min_rtt=712&rtt_var=975&sent=6&recv=10&lost=0&retrans=0&sent_bytes=4017&recv_bytes=3023&delivery_rate=5823056&cwnd=254&unsent_bytes=0&cid=40c78089d0d67677&ts=32&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Tue, 08 Apr 2025 17:37:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 LinkShare.Cl28zoGY.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 2 KB
1 KB 84ms
38ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LinkShare.Cl28zoGY.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1ce556665f40cf05d19b34b433fbcf4617673a73ee960beaee64405a3f6dbf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"fc5e11033898defa518d86b4d47b60d8"
age: 5170
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2YRpGKpIIQeRowO3uTsTERDC3CzqQ0DVTQ7%2FKm%2FQP2t72bUwxGw%2FnLSfFTnsYkioqzDGqp0rHYLVbYouFGqoPfU5zALMT7oCc0kPLIHI8oqxPjyOuuaOe3lQpe7cZ6ZnmBJ"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa82bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1480&min_rtt=712&rtt_var=1340&sent=52&recv=14&lost=0&retrans=0&sent_bytes=44286&recv_bytes=3054&delivery_rate=13858251&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=38&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Mon, 21 Apr 2025 21:00:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 emoji.26suwpww.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 9 KB
3 KB 80ms
35ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/emoji.26suwpww.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b346830ae8412dee5e7b821cf164d9cbc443ffdd606baaa37b2ef397aae14975

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"07f19d9bb489168f49611cd681630e33"
age: 3631
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oyil%2Fl7oMEO4KUMMpZ%2F0SL8%2FLODHjZTpYAy%2FMFrtJzaOUw4QnKFx45FP90WEz9yGcfZDGyiyzep82dSdQNGdGEyq1wO90ySjwhgSsH9H1%2FAtIOgy7evxQEI9hHwq8WJ3ysho"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fab2bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1034&min_rtt=712&rtt_var=597&sent=44&recv=13&lost=0&retrans=0&sent_bytes=37975&recv_bytes=3054&delivery_rate=5910204&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=36&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Mon, 21 Apr 2025 21:00:15 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 Svelecte.DIf5qRu2.1.0.0.css
givebuttercdn.com/apps/prod/build/ Frame E2AE 7 KB
3 KB 73ms
27ms Stylesheet
text/css 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Svelecte.DIf5qRu2.1.0.0.css
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1a265736848ddd027d8f640c0078da748d36604187ff08b55b9b8edab3f8f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"c3c9ed092294453bf977f27510c4f095"
age: 6780
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JeFrjrNmaORy4rHAmB%2BR0AyRgzufJcOECVMKkHmgKwDhRnc3LWPS1%2B2MMdjFAiy0NSP3wGbb2hk9hpgJ%2B6Uip9bzanM%2FAG4X4tNnJ%2FyTOhKollCHJEyKHsa%2F38lwD4YJgp1f"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cc68fa22bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=1105&min_rtt=712&rtt_var=844&sent=9&recv=11&lost=0&retrans=0&sent_bytes=5021&recv_bytes=3054&delivery_rate=5823056&cwnd=255&unsent_bytes=0&cid=40c78089d0d67677&ts=33&x=0"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/css
last-modified: Fri, 11 Apr 2025 16:40:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 embed.lFim9v84.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 1 KB
1 KB 1104ms
25ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/embed.lFim9v84.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eafde1b9321c5218874c0c1058664721eaa0c69a6846fed417c392cd3c0d5418

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"01aed928ebd8f1e66a38b499a8608527"
age: 2876
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sv24N1Z6Z3a1602ngFMXsljMu4FpBs9vmJAZZFz%2BZhRHv0RJXXIDJqBsHk7lIVnPgPn5pLN5w6pB6Rn3ewongIwuMF3RDsX01pqUKmfaodnktjwKIwD%2B6jecS8rVV4JGCDY%2F"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb89362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=978&min_rtt=617&rtt_var=605&sent=19&recv=14&lost=0&retrans=0&sent_bytes=13683&recv_bytes=3704&delivery_rate=11966942&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=33&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:08:07 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 Flow.BPkqgaF8.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 306 KB
74 KB 1130ms
51ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Flow.BPkqgaF8.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad494e9aacbcc5547f12c8293d92fa47e9e3597fe246bacc1f57efd2b400b437

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"04de9b73eda95f2bf3c691c36889b13a"
age: 5069
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VrBip2Ri3ffWsjVARD3HdjZJYa%2FvDDmVsJh7AcaiCe7knFHfGEbQETksV%2BnZvZwb1dhOmI9hgUA40yUTl9ouUSfg8Poj6Pvm1oA47XUzH2Q5NJ1J0EVA4xI%2F0%2BPfyqmCLuUL"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b94362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=740&min_rtt=610&rtt_var=74&sent=314&recv=109&lost=0&retrans=0&sent_bytes=395426&recv_bytes=3704&delivery_rate=125756823&cwnd=267&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=44&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:08:05 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 EventTicketsFlow.Cq-UwxQ1.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 17 KB
7 KB 1104ms
25ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/EventTicketsFlow.Cq-UwxQ1.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d890e2e4c70263205b52c10bac30491c0d7a13ebe5b3ee1123825eade66d097b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"039fcf71f4321e92167ca339dab99c8f"
age: 3632
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WkG223QJECS%2F%2FQvnYW6g5uH0iF2H6%2B0j5n2H2nL9j%2FCVlkhiticIYgvP8JD24lARrE9GuUEvcsY2QrDrxxknD18JwLWqKGdHPyzQZ82SI9sUhF9Q1ATtVfsaXwCoi4zGoGwg"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb91362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=892&min_rtt=617&rtt_var=382&sent=22&recv=17&lost=0&retrans=0&sent_bytes=14968&recv_bytes=3704&delivery_rate=19436241&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=34&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Fri, 09 May 2025 20:07:13 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 globe@2x.Btpk9ooJ.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 101 KB
35 KB 1122ms
43ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cc88e309177d92c0dbc370458cf4739082e37e2b988c50a8002a1433c052593

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"8bc23b922982b2c71be7b6cca0729899"
age: 2209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYGtEi9OaIK7C3VqNnQKNelpPRqUgDQ4FMalntje6MvqH%2BpfOOSnFRyfHf9wLk7jQmDsGOEy8dz0WoQUkk7SFHhxmwLvVczp6LM4uxWCtfT%2Bj2HnPTf8Op2z6IjW2Cd2w3mn"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb90362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=724&min_rtt=610&rtt_var=10&sent=127&recv=70&lost=0&retrans=0&sent_bytes=148671&recv_bytes=3704&delivery_rate=80944099&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=41&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:20 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 _commonjsHelpers.D6-XlEtG.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 731 B
1 KB 1101ms
22ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/_commonjsHelpers.D6-XlEtG.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c67d6a406ff72f17cfbbfaed1574f1ffce1d15c26c4496ebac83e606becda886

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"0314008884c7cb282d9aa919982c5718"
age: 5967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q20CGb%2FqHURTRo5CWQPRhQhUXzt4PgckTU3XtfnSWBtklJixSCGz6eIxq6fXmqc8PdbBPHwT9Em2UsMGgGkmpbc3vIZC7RiQglIm5cfUwZ9dENpyd3KKFHUy%2BOD%2Bh7ztBWh4"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb8e362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=1167&min_rtt=646&rtt_var=1140&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3995&recv_bytes=3673&delivery_rate=6388235&cwnd=253&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=31&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:19:54 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 ContactInfo.B2CUzmcH.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 20 KB
7 KB 1102ms
23ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/ContactInfo.B2CUzmcH.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94463d6613d2657c837b25ea591747d6ee86700dcaed5800f34591cf2230afb5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"dbc904a61573344752f764a5f4a5864a"
age: 2208
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YwWCdZRyh%2F0y63EeUTLMaa4lbO75JXcUzrBn22JBFFes6NczVTlvKc6PWmJNHVyeFS98k9lOTBSUcoiKVGBFhlDIXkLZC3ZX3ZN7poKf7nfUMjr5A7pd109OfZnd4WN4SrJZ"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb8c362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=1167&min_rtt=646&rtt_var=1140&sent=12&recv=10&lost=0&retrans=0&sent_bytes=6159&recv_bytes=3673&delivery_rate=6388235&cwnd=253&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=32&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:31 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 LabeledPhoneInput.DEqwDrCx.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 71 KB
22 KB 1115ms
36ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LabeledPhoneInput.DEqwDrCx.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df5ea2615f1e65c25f3100090d372768cecf9c0485138bb61c5ccee0a1f42f2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"7b7b0fa6605406af2db30ad1922d6710"
age: 2209
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4SFp%2BvcW1xaja8obXj8%2FJSabwblsEYuQrKhGkK8kyRm6%2BQLQQTfinflDyuQjR7AKjoY%2Fx13GhhxA95MJGszCe1rK9LHf50gz27BfHKTYD961%2Fe9vBehnzg1pFrMNIfu2yO26"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0ba0362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=906&min_rtt=610&rtt_var=379&sent=74&recv=33&lost=0&retrans=0&sent_bytes=78323&recv_bytes=3704&delivery_rate=34649874&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=40&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:08 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 filepond-plugin-file-validate-type.esm.B_ANaPmy.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 105 KB
36 KB 1131ms
52ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/filepond-plugin-file-validate-type.esm.B_ANaPmy.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe6d410b84a3f94a20c4be9625ea8a41ec7f825e6e707ee6ee57d992f065cc5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"6a359d4c3a6bcb7c99930d8552f75403"
age: 5967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z990NOcA6H2OEVgKO%2Bi5NM0vJ8RZXyOL03zmZnAY4EPRRp0EbS8F52yIQ6V%2FFxtOlwmx1CU1dZ8P967t3SxEXzL4lJbgDV5fqwhJSmWOx8SiD%2BPAXPpET%2FoLqVGvHym5%2Fw9y"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b9f362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=730&min_rtt=610&rtt_var=15&sent=372&recv=120&lost=0&retrans=0&sent_bytes=471547&recv_bytes=3704&delivery_rate=144616940&cwnd=293&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=44&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:37:04 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 index.DYVuyAVS.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 780 KB
59 KB 1123ms
44ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/index.DYVuyAVS.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 540be8c635852201795247d645c29293a6b7cb6d6fb05e22a8676b52d91fee19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"c9c50fb18232aed6ba2979c69b9f0e0f"
age: 1688
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPUBMBTXNHlsBq31hbXeNRSDSAaVN0Q9VhC9Q63Rc6VRQVObFdLMgOOkibPTMB3Ts1ts%2BT09c1EjQ5nvw0XjNc8DxzigPn2EEQMy1MvcJBX484BEm6bPxSwZiIuHDfvUPfNq"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b9d362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=724&min_rtt=610&rtt_var=10&sent=155&recv=70&lost=0&retrans=0&sent_bytes=184877&recv_bytes=3704&delivery_rate=80944099&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=41&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 16 Apr 2025 18:28:56 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 numeral.B_3j-8rd.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 11 KB
5 KB 1107ms
29ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/numeral.B_3j-8rd.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56b197972b901062f7ddd1da69d3cba8213671539f5b04272818cfb385de5301

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"3921961247d7b82ea43090bdeeb47287"
age: 5967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xvFb%2FFF9Lc5mA8%2FJ%2FWv16OOTfTlSUy2yGA2VXaeMRC69OlnHTWrlxxxEvBQl%2F40cb9%2BRfEEVr9OJ1aWTk3IkFRN0TpGsSZ6RQJVUDh%2FS0x9p8XLPFZ2HCD7uOBKlOmf4fm4X"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b9c362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=840&min_rtt=617&rtt_var=243&sent=28&recv=21&lost=0&retrans=0&sent_bytes=22502&recv_bytes=3704&delivery_rate=19436241&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=38&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:36:41 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 PaymentAccordion.BfPQcHbS.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 75 KB
22 KB 1109ms
30ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/PaymentAccordion.BfPQcHbS.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2cd69554b92111a977a7dad5894fab189378b6a52b754021100b9ab11a34489

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"13f908bed7ff8a1bcce6582c22aa5d5c"
age: 1222
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l2Yq8d%2BGAOJInyIQBG3XacN8tgrFmtRwu6jXITFfYASUEwpP3B2H8FjavzgRKneUvimd2YgkP4BoXqOzzkWS%2BxPujX8n6TA9OyFR%2BTUoZaQwGJcVyRrGLsJxtmxs4G2TyRR6"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b9b362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=840&min_rtt=617&rtt_var=243&sent=34&recv=21&lost=0&retrans=0&sent_bytes=27521&recv_bytes=3704&delivery_rate=19436241&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=39&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:02:06 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 LinkShare.BaRoQU2N.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 118 KB
44 KB 1125ms
46ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/LinkShare.BaRoQU2N.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 297bd0260f572990cfa4545594c1510192ae33b78ec211ebb84aa74d79ceb1a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"00af9810169265a6cac0398c2a858e98"
age: 1222
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2NAFsHQ8g0EFuGgOMXa2Ybp%2BDgS0%2F%2Bk0dQxkFJTlAgzO%2F4yvsBFQLCgl8vAPhskIsbktaa0shEZWRs9PzsZ4oqdQKvnFmKV35yFKhaMxBzmrV6HfuV0GeheJ8Qxro3ouJsKI"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b9a362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=713&min_rtt=610&rtt_var=12&sent=201&recv=72&lost=0&retrans=0&sent_bytes=245359&recv_bytes=3704&delivery_rate=80944099&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=41&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:37 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 emoji.DUOHsx9g.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 825 KB
151 KB 1132ms
53ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/emoji.DUOHsx9g.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0399699a7279e9e5c8b1fef1962029bdd83c8883e9ef314e5585cded68304f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"012476b199961e2c37b98843b930a4f5"
age: 1222
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fl9IJri3AwAENZ8FdyHUfTK7xYqIsR0cQkDwSKxtWE447tPdkdZ0SK16piLLee6Ij1Ep1H8o9uD6iyau4jIjTqQE4hKZcoXeuGJN1I8q51KxEXHldIAgXT3JraDtiUOhpomB"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b97362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=790&min_rtt=610&rtt_var=37&sent=400&recv=143&lost=0&retrans=0&sent_bytes=508311&recv_bytes=3704&delivery_rate=157515072&cwnd=328&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=44&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:48 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 client.DZflzfXp.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 139 KB
46 KB 1118ms
39ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/client.DZflzfXp.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c118d1fca2998e4679455c91d4a0eb4a516d3d49bff9540bca8e3c6d21118a2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"d298586e7a26ca45c074b69588c526b9"
age: 4838
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F83bl0zjzQBFdyazlXwBsIOICttZJBm5fhGpLwYE%2F5tH62eIXH3TMvPaPZ1xxhCW%2Fq4FkCJofAaZAa1Z0vtWjJDqvd9TSZt2J75pNkA4Gkgjp3VW72zYZCJ6rcqKud69ArP3"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0b96362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=847&min_rtt=610&rtt_var=316&sent=92&recv=35&lost=0&retrans=0&sent_bytes=101159&recv_bytes=3704&delivery_rate=36468148&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=40&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Tue, 08 Apr 2025 17:38:07 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 Svelecte.RSFjb1Xx.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 72 KB
27 KB 1111ms
33ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/Svelecte.RSFjb1Xx.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a431b44f5dee485517960556b3400da39d89716fec8fa3d8691a66d3d42f8560

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5b473bc7e676a07ce6bbb0916333073c"
age: 1682
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2nZ9JJ%2BFIhnWbHJPNRWctzjCYPPrBOl628lNjwT7clJNy4q1erZvF7B6Aa2vQan%2BxBLz8BlZ%2FVgqtMaWDvET7o5PVlGTQ6rvhjTJQgr2Q%2BzfUovolMNYyeLAJog%2BI0M20s2t"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01ccd0ba1362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=1234&min_rtt=617&rtt_var=847&sent=52&recv=25&lost=0&retrans=0&sent_bytes=50268&recv_bytes=3704&delivery_rate=19436241&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=40&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Wed, 07 May 2025 23:01:14 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 index.D4uN2bNE.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 121 B
787 B 1101ms
23ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/index.D4uN2bNE.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afc1b28f4f82c7ced1664c9fdf044c4a2570ed9e96da9ed548103b7a01000b08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"940b2e789d3a5626f224e214f29105fd"
age: 5967
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9lKkvRkfC%2FVrtK5NwAqnHlP5yOfw4O5vFYQV5mViHJTuwSbyDwUMoqnxTl1DYLBW14iMzeUiWYvrg9ElgCs9UiwBp4Y%2Br%2FEhep70PvtZU%2BMbp0En1NHNB72YdMf66BwmWftq"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb86362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=1167&min_rtt=646&rtt_var=1140&sent=9&recv=10&lost=0&retrans=0&sent_bytes=5306&recv_bytes=3673&delivery_rate=6388235&cwnd=253&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=32&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Thu, 17 Apr 2025 22:11:10 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 datetime.BpX6K-10.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 381 KB
102 KB 1127ms
49ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1395f9dfbc141826fbc67b90204496b4cc97d9ac6171ff4c88ace15abc649850

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"5e6f3d53dfdaea0754d93264aad7335b"
age: 1166
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsLZ6lE3BsYNdgMfwKZbECSY6p8uz40%2BST51xoU1fKBSfYpJk208JYVFwFmeoXQY2oQ7aqIgovxs3EhEcnzzE%2FHLVAS18bMs7Tlpz39UWkWv1NbQrAsjlZkYfYoL5Z2tIfvx"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb8b362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=728&min_rtt=610&rtt_var=32&sent=236&recv=86&lost=0&retrans=0&sent_bytes=291030&recv_bytes=3704&delivery_rate=80944099&cwnd=256&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=44&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:20:17 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 usePosthog.CpoFC8fX.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 176 KB
57 KB 1135ms
56ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0a863df8ff7675e7f475e64dcd92f6cb648e7c6953c2cb51aaea986a25d9ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"2764a7daaa24eedd86ad619dd402b276"
age: 122
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vMf5mqCZeN6eXLuyM7lXpU7wcDtCI81tKju47hXOkjaYYZdj671pWfPe52iyy1t%2B10fWzqti3eHkZ6NJksH9e0bzW9NllaMWM7aN27DbhkyfaT%2FLbTn18IfdoaWV7uym1IwW"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cccfb8a362f-FRA
access-control-allow-origin: https://givebutter.com
server-timing: cfL4;desc="?proto=TCP&rtt=748&min_rtt=610&rtt_var=40&sent=516&recv=249&lost=0&retrans=0&sent_bytes=662929&recv_bytes=3704&delivery_rate=287669333&cwnd=487&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=53&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Mon, 14 Apr 2025 14:20:34 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame E2AE 19 KB
7 KB 50ms
27ms Script
text/javascript 104.16.80.73
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.80.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 93e01cc6fd4e4d5a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 333 KB
105 KB 42ms
42ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Requested by

Host: cdn.sy57d8wi.com
URL: https://cdn.sy57d8wi.com/prod/spokesman/g2i.min.js?2025411

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4a925c97add89114b1a2147ac8d0df86cec22526a957795fc0b87c365d292ee8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Sun, 11 May 2025 07:55:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 11 May 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 107839
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 index.js Show response
cdn.pranmcpkx.com/ 7 KB
3 KB 128ms
17ms Script
text/javascript 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.pranmcpkx.com/index.js
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-azure-ref: 20250511T075509Z-15f677d574b2qp9thC1FRA5qps00000005yg00000000551f
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 75
x-ms-request-id: 88108b53-301e-0048-36b7-c0ea89000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:09 GMT
x-ms-blob-type: BlockBlob
content-type: text/javascript
vary: Accept-Encoding
last-modified: Fri, 17 Jun 2022 17:08:13 GMT

GET
H2 200 SR__SPOKESMAN.json Show response
cdn.e3fbosf1tz3d.xyz/prod/data/spokesman/ 1 MB
80 KB 428ms
427ms Fetch
application/json 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.e3fbosf1tz3d.xyz/prod/data/spokesman/SR__SPOKESMAN.json?_=1746950109161
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d570f130ada6f735a85879c5a7b01c106bdd124b80892ed66af241dbf85b86e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-committed-block-count: 1
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD8EAA8ECE5ACD
x-ms-lease-status: unlocked
x-cache: CONFIG_NOCACHE
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/json
last-modified: Fri, 09 May 2025 03:35:34 GMT
cache-control: no-cache
x-ms-request-id: cc5ec4eb-001e-0098-044a-c2d7df000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 80799
x-azure-ref: 20250511T075509Z-15f677d574bgd28whC1FRAkhu8000000055000000000cex9
x-ms-blob-type: AppendBlob

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 417ms
199ms Image
image/jpeg 52.217.163.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.217.163.217 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-amz-meta-s3b-last-modified: 20191015T134358Z
ETag: "ef2cc7f55b7ab677b023e36033e26471"
x-amz-request-id: YBA2RAYA9B4S7V1H
Accept-Ranges: bytes
Content-Length: 631
Date: Sun, 11 May 2025 07:55:10 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Content-Type: image/jpeg
Server: AmazonS3
x-amz-id-2: hJltCwzz2tbYcfhebId01BN3B9IwGem9Ox3pnbxRsCDUWq1Rz2eQUcT1CQwq4VgdPa818wRoIP0=

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame E2AE 52 KB
21 KB 36ms
7ms Script
text/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-75318216-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: gzip
age: 3049
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 09:04:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:04:20 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame E2AE 249 KB
74 KB 7ms
7ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=e11dd02663805d1c8cbbe37c165f4e57

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

f389ec7b05bbbed807a5a7114b3c011141d7c20ff9e6b5eb6591b40e6024f150

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

content-md5: ILFYs8+XD+vGJLaotCSZOQ==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "42eb4e67d32e73ac060cce2380566952"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 07:06:23 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 8e13a78d44fa7d992c949c88e8f8def1
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=27, mss=1232, tbw=9192, tp=16, tpl=0, uplat=0, ullat=-1
x-fb-debug: xOnJP7TtvsTQS6wJIkC/Zg9NZRYw4zh3Wq+at2XAmj9VHBjSQMtOJTPfoPSzpQ3rCteRWlZ/C196maTC5ehyBA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 75309
origin-agent-cluster: ?1

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ Frame E2AE 3 B
44 B 75ms
59ms XHR
application/json 142.250.185.74
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://givebutter.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
date: Sun, 11 May 2025 07:55:09 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H2 200 pro-v4-shims.min.js Show response
ka-p.fontawesome.com/releases/v6.6.0/js/ Frame E2AE 26 KB
7 KB 28ms
18ms Fetch
application/javascript 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/js/pro-v4-shims.min.js?token=c37fafd8d9
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c37fafd8d9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 128243e3d76f97a40e2d6a650a46363351f11f9a10be7e3603471f82b0a458fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: "6695a0b8-1be0"
age: 341124
cf-ray: 93e01cc828b0078a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7136
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 15 Jul 2024 22:20:40 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 pro.min.js Show response
ka-p.fontawesome.com/releases/v6.6.0/js/ Frame E2AE 50 KB
16 KB 39ms
30ms Fetch
application/javascript 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/js/pro.min.js?token=c37fafd8d9
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/c37fafd8d9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de530d97ee086c1c3765ee23249e028e2c3e47d83318e848a19812ef68966dc9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: "6695a0b9-4003"
age: 2265748
cf-ray: 93e01cc838db078a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16387
date: Sun, 11 May 2025 07:55:09 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 15 Jul 2024 22:20:41 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 52ms
27ms XHR
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 9180026253815486264
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52272
x-xss-protection: 0
server: cafe

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 29ms
28ms XHR
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 15567459528276047897
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52272
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK views Show response
prod-spokesman-proxy-connext.azurewebsites.net/api/ 90 B
1 KB 184ms
184ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=2561fb0016fc32abc1b39f655d4d1d0b&ConfigCode=SPOKESMAN&SiteCode=SR
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE4MTg5NTAxMDl9.CoM-iPrCmV9VV6pTZGTEwr2skkyUQUktiUVaJuV3Jy0
location: System
Referer
config-code: SPOKESMAN
site-code: SR
autoqa: false
settingskey: null
access-control-allow-origin: *
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
accept: application/json
content-type: application/json
environment: prod
version: Version: 2.8.7.1
source-system: Plugin
ssid: bbfd99a6798afc38bcf89d491455ec0c

Response headers

Access-Control-Expose-Headers: X-Server-Time,Request-Context
Content-Encoding: gzip
Expires: -1
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000, 00000000-0000-0000-0000-000000000000
Date: Sun, 11 May 2025 07:55:09 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
Cache-Control: no-cache
X-AspNet-Version: 4.0.30319
Pragma: no-cache
Request-Context: appId=cid-v1:3511aa5f-8d6c-4d6d-8b4f-ff9812ddbbcc
Access-Control-Allow-Origin: *
Content-Length: 193
X-Server-Time: 5/11/2025 7:55:10 AM
X-Powered-By: ASP.NET, ASP.NET
Server: Microsoft-IIS/10.0, Microsoft-IIS/10.0

OPTIONS
H/1.1 200
OK views
prod-spokesman-proxy-connext.azurewebsites.net/api/ Frame 0
0 721ms
268ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=2561fb0016fc32abc1b39f655d4d1d0b&ConfigCode=SPOKESMAN&SiteCode=SR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method: GET
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Sun, 11 May 2025 07:55:09 GMT
X-Powered-By: ASP.NET
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 256 KB
37 KB 187ms
187ms Fetch
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3745048750418345&correlator=4286741265144264&eid=31086814%2C31092333%2C83321072%2C31086810&output=ldjh&gdfp_req=1&vrg=202505060101&ptt=17&impl=fifs&iu_parts=1009641%2CSpokesmanDesktop_News_Top_728x90%2CSpokesmanDesktop_News_Top_300x250%2CSpokesmanDesktop_SideRail_100x525%2CSpokesmanDesktop_News_Middle_300x250%2CSpokesmanDesktop_News_Footer_728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%2C300x250%7C300x600%2C100x525%2C300x250%2C728x90&ifi=1&dids=adbridg_ad_adbdtlbtop_1~adbridg_ad_adbdtsiderailtop_1~adbridg_ad_adbdtsiderailros_1~adbridg_ad_adbdtsiderailbottom~adbridg_ad_adbdtbottomlb_1&adfs=1211021519~715260756~2024556104~3467408886~3552575421&sfv=1-0-44&fsbs=1%2C1%2C1%2C1%2C1&eri=1&sc=1&abxe=1&dt=1746950110194&lmt=1746950110&adxs=1636%2C2436%2C1500%2C2436%2C1636&adys=223%2C340%2C338%2C961%2C4288&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C1&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vis=1&psz=4000x101%7C300x0%7C100x-1%7C300x0%7C1472x0&msz=4000x101%7C300x0%7C100x-1%7C300x0%7C1472x0&fws=1028%2C1028%2C1540%2C1028%2C1028&ohw=1600%2C1600%2C1600%2C1600%2C1600&topics=5&tps=5&htps=5&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1746950107601&idt=280&prev_scp=pos%3Dlb_top%26adb_imp%3DS105.1%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dsiderail_top%26adb_imp%3DS108.2%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dsiderail_sponsorship%26adb_imp%3DS100.3%2C1%2Clzs_dt%7Cpos%3Dsiderail_bottom%26adb_imp%3DS106.4%2C1%2Clzs_dt%26adb_bdr%3Dnone%7Cpos%3Dlb_bottom%26adb_imp%3DS104.5%2C1%2Clzs_no%26adb_bdr%3Dnone&cust_params=tags%3Debola%2520outbreak%252Csex%2520abuse%252Cworld%2520health%2520organization%252Ccongo%252Cunited%2520nations%26section%3DNews%26category%3Dnation-world%26adb_pvd%3Dt5a&adks=2339051370%2C2987418812%2C1176090967%2C1674678964%2C3630864184&frm=20&eoidce=1&gblpids=%2F1009641%2FSpokesmanDesktop_News_Top_728x90~%2F1009641%2FSpokesmanDesktop_News_Top_300x250~~%2F1009641%2FSpokesmanDesktop_News_Middle_300x250~%2F1009641%2FSpokesmanDesktop_News_Footer_728x90&pbbce=1&td=1&egid=50433&tan=2ad740d0-feb8-45e6-ab29-6e881fa46fc9%2C2ad740d0-feb8-45e6-ab29-6e881fa46fca%2C2ad740d0-feb8-45e6-ab29-6e881fa46fcb%2C2ad740d0-feb8-45e6-ab29-6e881fa46fcc%2C2ad740d0-feb8-45e6-ab29-6e881fa46fcd&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

2304236f31bac2a5cfa8519c2ea5de2db40be11589620f76aac0ffaa777c6762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: 6942752544,6942752544,-2,6981021006,6950813419
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138511603623,138511744766,-2,138515815173,138517271803
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
content-length: 37697
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com/safeframe/1-0-44/html/ Frame 4466 7 KB
3 KB 59ms
19ms Document
text/html 142.250.184.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 07:55:10 GMT
expires: Sun, 11 May 2025 07:55:10 GMT
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 894ms
334ms Image
image/png 52.32.178.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2majczm50Qphu2N4a8R,7ZunmTSpYT&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,1t9,0,1,1,1,1,1,0,0,0,0,1,0,0,0,0,5,5,5,5&b=a0&b=v3Y,1&b=I1,1H,1,2,:g3,4:,:s5:1h,:h1:1,1,6,,6,:r66,:D,1C,,1,,7,3B,0::,:S7K,:Rb,64,g:,:Rl,bQ,1S:,:Rd,Dz,x:,:Ru,QM,2Z:,:Rz,QX,2P:,:Rp,WT,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aJ,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,1C,,1,,7,3B,0:,:H,,,0::,:CBs,:b,:Rb,64,g:0,,21,,0:,:b,:Rl,bQ,1S:0,,23,,0:,:b,:Rd,Dz,x:0,,1L,,0:,:b,:Ru,QM,2Z:0,,3u,,0:,:b,:Rz,QX,2P:0,,,,0:,:b,:Rp,WT,2T:0,,1Q,,0:,:b,:Ro,1rf,2W:0,,2f,,0:,:b,:RJ,1NL,3e:0,,3h,,0:,:b,:RZ,2aj,3t:0,,2h,,0:,:b,:RX,2aJ,3u:0,,1l,,0:,:b,:RY,2aK,3v:0,,1P,,0:,:b,:R19,2cF,3x:0,,6f,,0:,:D,E,,1,,q,3B,0:,:H,,,0::,:qBN,7,8,:D,E,,1,,q,3B,0::&b=I8,1K,1,9,:g3,a:,:sb,c:1j,:h1:1,3,6,:sc,b:6,:r67,:D,,,1,,d,5e,jW::,:S7K,:Rb,66,g:,:Rl,bT,1S:,:Rd,DA,x:,:Ru,QO,2Z:,:Rz,QZ,2P:,:Rp,WV,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aH,3u:,:RY,2aL,3v:,:RY,2aN,3v:,:R19,2cF,3x:,:D,,,1,,d,5e,jW:,:H,,,0::,:CBs,:b,:Rb,66,g:0,,21,,0:,:b,:Rl,bT,1S:0,,23,,0:,:b,:Rd,DA,x:0,,1L,,0:,:b,:Ru,QO,2Z:0,,3u,,0:,:b,:Rz,QZ,2P:0,,ts,,0:,:b,:Rp,WV,2T:0,,1Q,,0:,:b,:Ro,1rf,2W:0,,2f,,0:,:b,:RJ,1NL,3e:0,,3h,,0:,:b,:RZ,2aj,3t:0,,2h,,0:,:b,:RX,2aH,3u:0,,1l,,0:,:b,:RY,2aL,3v:0,,1P,,0:,:b,:RY,2aN,3v:0,,1P,,0:,:b,:R19,2cF,3x:0,,6f,,0:,:D,,,1,,d,5e,Di:,:H,,,0::&b=Ie,1C,1,f,:g3,g:,:sh:0,:h1:,:r67,:D,,,1,,i,9G,pO::&b=Ij,1I,1,k,:g3,l:,:sb:1l,:h1:1,6,6,,6,:r67,:D,,,1,,d,ff,jW::,:S7K,:Rb,68,g:,:Rl,bR,1S:,:Rd,DB,x:,:Ru,QQ,2Z:,:Rz,R1,2P:,:Rp,WX,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aF,3u:,:RY,2aL,3v:,:R19,2cF,3x:,:D,,,1,,d,ff,jW:,:H,,,0::,:CBs,:b,:Rb,68,g:0,,21,,0:,:b,:Rl,bR,1S:0,,23,,0:,:b,:Rd,DB,x:0,,1L,,0:,:b,:Ru,QQ,2Z:0,,3u,,0:,:b,:Rz,R1,2P:0,,ts,,0:,:b,:Rp,WX,2T:0,,1Q,,0:,:b,:Ro,1rf,2W:0,,2f,,0:,:b,:RJ,1NL,3e:0,,3h,,0:,:b,:RZ,2aj,3t:0,,2h,,0:,:b,:RX,2aF,3u:0,,1l,,0:,:b,:RY,2aL,3v:0,,1P,,0:,:b,:R19,2cF,3x:0,,6f,,0:,:D,,,1,,d,ff,Di:,:H,,,0::&b=Im,1G,1,n,:g3,o:,:s5:1m,:h1:1,7,6,,6,:r67,:D,,,5,Ny,p,16U,12::,:S7K,:Rb,69,g:,:Rl,bO,1S:,:Rd,Dz,x:,:Ru,QR,2Z:,:Rz,R2,2P:,:Rp,WY,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aE,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,,,5,Ny,p,16U,12:,:H,,,0::,:CBt,:b,:Rb,69,g:0,,21,,0:,:b,:Rl,bO,1S:0,,23,,0:,:b,:Rd,Dz,x:0,,1L,,0:,:b,:Ru,QR,2Z:0,,3u,,0:,:b,:Rz,R2,2P:0,,ts,,0:,:b,:Rp,WY,2T:0,,1Q,,0:,:b,:Ro,1rf,2W:0,,2f,,0:,:b,:RJ,1NL,3e:0,,3h,,0:,:b,:RZ,2aj,3t:0,,2h,,0:,:b,:RX,2aE,3u:0,,1l,,0:,:b,:RY,2aK,3v:0,,1P,,0:,:b,:R19,2cF,3x:0,,6f,,0:,:D,,,5,Ny,p,16U,ko:,:H,,,0::&b=GBN,1,:Kr,:ks,t,u,v,w:x,:ky:z,:kA:B,:kC::,:L1,8,e,j,m:&b=KD,:kE:&bi=Uga016RGIcSa1,adbridg_ad_adbdtlbtop_1,1009641,SpokesmanDesktop_News_Top_728x90,728x90,0.05,1600x101,U1s026RGIcSa2,adbridg_ad_adbdtsiderailtop_1,SpokesmanDesktop_News_Top_300x250,300x250,300x600,300x0,Ux8036RGIcSa0,adbridg_ad_adbdtsiderailros_1,SpokesmanDesktop_SideRail_100x525,100x525,0x0,Uu2046RGIcSa3,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,Uwd056RGIcSa4,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,1472x0,4000x101,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,pos,lb_top&bt=uKScCuT&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.majczlwd.2T8f&g=2T21p&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.3yx.1.0&adbj=gbv3majczm34erm&mp=0.3&adb_cm=t5a&txx=Txx1&rnd=1746950110203
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.178.217 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-178-217.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 844ms
333ms Image
image/png 52.32.178.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2majczm50Qphu2N4a8R,7ZunmTSpYT&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,1w2,0,1,1,1,1,1,0,0,0,0,1,0,0,0,0,5,5,5,5&b=I1,1K,1,2,:g3,4:,:s5,6:1j,:h1:1,3,7,:s6,5:7,:q0,1,2,:D,,,1,,8,5u,Di::&b=G0,1,:K9,:ka,b,c,d,e:f,:kg:h,:ki:j,:kk::,:Ll,1,m,n,o:&b=Kp,:kq:&b=Im,1C,1,r,:g3,s:,:st:0,:h1:,:q1,1,4,:D,1C,,1,,t,5r,oc::&b=Kp,:ku:&b=In,1I,1,v,:g3,w:,:s5:1l,:h1:1,6,7,,7,:q1,1,6,:D,,,1,,8,fv,Di::&b=Kp,:kx:&b=Io,1G,1,y,:g3,z:,:sA:1m,:h1:1,7,7,,7,:q1,1,8,:D,,,5,NO,B,17a,ko::&b=Kp,:kC:&bi=U1s026RGIcSa2,adbridg_ad_adbdtsiderailtop_1,1009641,SpokesmanDesktop_News_Top_300x250,300x250,300x600,0.05,300x0,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,Uga016RGIcSa1,Ux8036RGIcSa0,Uu2046RGIcSa3,Uwd056RGIcSa4,pos,siderail_top,adbridg_ad_adbdtsiderailros_1,SpokesmanDesktop_SideRail_100x525,100x525,siderail_sponsorship,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,siderail_bottom,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,728x90,1472x0,lb_bottom&bt=uKScD6G&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.majczlwd.2T8f&g=2T24i&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.3yx.1.0&adbj=gbv3majczm34erm&mp=0.3&adb_cm=t5a&txx=Txx2&rnd=1746950110304
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.178.217 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-178-217.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

GET
H2 200 config.js Show response
ph.givebutter.com/array/phc_cwIyuSjjEpyhbDj5a0cRqmSpB5O8CyMDb7ZBiS8MRy7/ Frame E2AE 935 B
828 B 385ms
107ms Script
application/javascript 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/array/phc_cwIyuSjjEpyhbDj5a0cRqmSpB5O8CyMDb7ZBiS8MRy7/config.js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7f23af6adc7ea6c31b559530d3d85ae93198314ce5844b7d452a158a07432560

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 13
x-content-type-options: nosniff
allow: GET, HEAD, OPTIONS
referrer-policy: same-origin
access-control-allow-origin: *
content-length: 567
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/javascript
vary: Origin, Referer, Accept-Encoding
server: envoy
x-frame-options: SAMEORIGIN

POST
H2 200 / Show response
ph.givebutter.com/decide/ Frame E2AE 970 B
589 B 474ms
196ms Fetch
application/json 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/decide/?v=3&ip=1&_=1746950110399&ver=1.212.1&compression=base64

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

1cc2b777ed8a6ec44643a3497e17ad131e75bb592e6fdd5ef9e82fa9658a0d45

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 15
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

GET
H2 200 utils-21.2.7.mLZ22td5.1.0.0.js Show response
givebuttercdn.com/apps/prod/build/ Frame E2AE 254 KB
61 KB 123ms
123ms Script
text/javascript 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/apps/prod/build/utils-21.2.7.mLZ22td5.1.0.0.js
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03ead4f04bab625255f63b23982637a01d410e17859484da407565bf957c35e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"63fd97bb5854053113365dfd9071ba8f"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dpf71OoK9SzpKCDwslpq6cgQNX1jWNHzPe9X%2FFTV%2BCO7pSgyQ66L0%2BoMkYXrtDR2%2FL60w3zI5mdqCHD7XFerq6K%2BWzD%2FkWWPm%2BPvE%2FgLgZBeUKm2f7sT%2BQZdRzVxWBzCgvZd"}],"group":"cf-nel","max_age":604800}
cf-ray: 93e01cce0c842bf6-FRA
server-timing: cfL4;desc="?proto=TCP&rtt=6371&min_rtt=707&rtt_var=10940&sent=56&recv=19&lost=0&retrans=0&sent_bytes=45614&recv_bytes=3290&delivery_rate=14644301&cwnd=257&unsent_bytes=0&cid=40c78089d0d67677&ts=1339&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript
last-modified: Thu, 17 Apr 2025 22:10:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 Donate%20-%20Heart%20Anim.json Show response
givebutter.com/storage/assets/flow/animation/ Frame E2AE 110 KB
5 KB 37ms
37ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Heart%20Anim.json

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a02f78e600e8272c473819f97a46a1c070f8ceeddaf29ac5655e371375e9456a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-1b8b4"
age: 1221
x-content-type-options: nosniff
cf-ray: 93e01cce19e62bb2-FRA
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 1; mode=block
content-type: application/json
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0847f913637d70027

GET
H2 200 Donate%20-%20Seal.json Show response
givebutter.com/storage/assets/flow/animation/ Frame E2AE 63 KB
3 KB 36ms
35ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Seal.json

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e554bc156b6e3a3d05525af219824241f504293f0300b40d8ca1385bbaf2b6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-fbf0"
age: 5068
x-content-type-options: nosniff
cf-ray: 93e01cce19e82bb2-FRA
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 1; mode=block
content-type: application/json
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0b9142f55306c0e03

GET
DATA 200
OK truncated
/ Frame E2AE 215 B
0 Image
image/jpg

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ Frame E2AE 66 B
0 Image
image/webp

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
H2 200 shield-check.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/ Frame E2AE 1 KB
735 B 23ms
23ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/shield-check.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3f4864802c06951ceafa99a8fb279608ad8916696cadd3c0ec4ae6ddb1d8136

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0f7-456"
age: 917780
cf-ray: 93e01cce198f078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:21:43 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 spinner-third.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/light/ Frame E2AE 459 B
413 B 37ms
36ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/light/spinner-third.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da0c53e8878f4d05a347a2edb7edcdb25e6c80dcea31f037b65c1103d0591a6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a18c-1cb"
age: 341124
cf-ray: 93e01cce39ac078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:24:12 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 arrow-left.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/ Frame E2AE 477 B
414 B 36ms
36ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/arrow-left.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e190004f753344f8dca8e365f2f3b1ad003c2198ead3ced744018bada78952de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a1d8-1dd"
age: 1822848
cf-ray: 93e01cce39ad078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:25:28 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 facebook.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame E2AE 516 B
455 B 34ms
34ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/facebook.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d0bb9556119625f4c7b1882f705e38fcfb5779a9d82985f8e96cb056d5a848d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0bb-204"
age: 4684520
cf-ray: 93e01cce39ae078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:43 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 x-twitter.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame E2AE 404 B
390 B 34ms
34ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/x-twitter.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4c1d392a90c31f031c21d7aa51f04d0bb359027db47c5234da034da75689961

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0c7-194"
age: 4069415
cf-ray: 93e01cce39af078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:55 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 linkedin.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame E2AE 672 B
520 B 37ms
36ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/linkedin.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6a55e008070dfa78b131827c914ccaadf3de9ddaf61b0938b1dc46fa3ae337c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0bd-2a0"
age: 1925223
cf-ray: 93e01cce39b0078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:45 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 whatsapp.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/ Frame E2AE 1 KB
710 B 39ms
39ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/whatsapp.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f08b9a120a041d6c73e69bc274d6261b474d3ec71151a8c2b940858e1026d8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a0c7-46e"
age: 2095059
cf-ray: 93e01cce39b2078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:20:55 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 envelope.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/ Frame E2AE 516 B
446 B 37ms
37ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/envelope.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 569014b221a3fec6083500d09ecd17f8739b6466d374cb152be16c6bc1ff05cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a53d-204"
age: 1840327
cf-ray: 93e01cce39b3078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:39:57 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 copy.svg Show response
ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/ Frame E2AE 700 B
477 B 39ms
39ms Fetch
image/svg+xml 104.18.40.68
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/copy.svg?token=c37fafd8d9
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a252b9a96e5aa3f0dc99c702219819ddf46cfdfba95f2e00f4e5d32387a634d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

cache-control: max-age=31556926
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6695a1e6-2bc"
age: 2130930
cf-ray: 93e01cce39b5078a-FRA
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:10 GMT
content-type: image/svg+xml
last-modified: Mon, 15 Jul 2024 22:25:42 GMT
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
server: cloudflare

GET
H2 200 Love%20Filled.svg
givebutter.com/storage/assets/flow/icons/24/ Frame E2AE 659 B
458 B 39ms
39ms Image
image/svg+xml 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://givebutter.com/storage/assets/flow/icons/24/Love%20Filled.svg

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15eca989381d4b9c996b23992775d3c24307d08baacc5ce34dc3ea33f68cb7f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

server: cloudflare
content-encoding: gzip
cf-cache-status: HIT
etag: W/"681e6580-293"
age: 1862
x-content-type-options: nosniff
cf-ray: 93e01cce29f52bb2-FRA
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 1; mode=block
content-type: image/svg+xml
last-modified: Fri, 09 May 2025 20:28:48 GMT
vary: Accept-Encoding
x-server: prod-app-i-0ec421e7f81e91214

GET
H2 200 usage Show response
givebutter.com/elements/api/v1/zN1p7WO2gDzLLkGa/elements/ Frame E2AE 51 B
839 B 480ms
480ms XHR
application/json 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/elements/api/v1/zN1p7WO2gDzLLkGa/elements/usage?url=https%3A%2F%2Fgivebutter.com%2Fembed%2Fc%2Fsupport-local-journalism%3FgoalBar%3Dfalse%26gba_gb.element.id%3Dp57vbL

Requested by

Host: js.givebutter.com
URL: https://js.givebutter.com/elements/latest.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a65146e588cb9b4da0ed50d019fa26b01f86f969f642b3207fdf121a3f9a9ac

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

content-encoding: gzip
cf-cache-status: EXPIRED
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff, nosniff
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/json
last-modified: Sun, 11 May 2025 07:55:10 GMT
vary: Accept-Encoding, Origin
x-server: prod-app-i-0f400e3c74f1e3128
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'self'
cache-control: max-age=57889, must-revalidate, public
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 93e01cce39f92bb2-FRA
cross-origin-embedder-policy: unsafe-none
permissions-policy: accelerometer=(self), autoplay=*, camera=(self), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=*, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self "https://js.stripe.com" "https://pay.google.com"), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
x-xss-protection: 1; mode=block, 1; mode=block
server: cloudflare

GET
H2

200

main.js Show response
givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/ Frame 2F5F
Redirect Chain

https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

8 KB
4 KB

16ms
15ms

Script
application/javascript

104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

Requested by

Host: givebutter.com
URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Protocol

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

704bedf7a9c2795b107f5b24b99b5275648c72a409ec3fa7b680de1a0f123144

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding: gzip
x-content-type-options: nosniff
cf-ray: 93e01cce7a232bb2-FRA
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
cf-ray: 93e01cce39fd2bb2-FRA
access-control-allow-origin: *
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 / Show response
ph.givebutter.com/e/ Frame E2AE 13 B
239 B 402ms
185ms Fetch
application/json 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/e/?ip=1&_=1746950110459&ver=1.212.1&compression=gzip-js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 8
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4D15 0
0 51ms
51ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsv2V75pFxb2H4RokmqrWKs7zYC0cG73zjpyfzYtOkpupBx4z1qFI-uthAKeHHEsTY9UnSOsKIP111bU2L1xgioOTm7bfhbyI_Z8Hf4FWS7rq1JCZF1XGG-wHV3eQfHVFaXDqq4yKD7N_x7ONId7WJ0j3edF7Isb8pIhxsohsxWZ3qQw4r7vFymrUCRy1lpbmbpnogM37fwA6yVsE3vKVMW2cOfVWJghYauRoR-OUi3586MIoLZWtCW3Iwf23IfCJwL1wH4kfGLno0lOrIwA1uo577ZmY1qhOKab3LLux45m_H2Ns4qb2r-EhBrZVQjPhj84y25wIVqDvwthepqkoPKqFK4Uqaz9eOc9SHmx1DS2TaFPlBoln0RSmcBHo-xVt7UsSo9sHNUk65Nx7DJ3vH8oJwOrqEYNONao4kks-hS_FqtCdx3MiF1vLMXANSKFaaABp65ki9GzdSFn4qo&sig=Cg0ArKJSzJyu-8pWzQhsEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame 4D15 21 KB
8 KB 31ms
31ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 49390
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame 4D15 3 KB
1 KB 33ms
33ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 49379
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4D15 221 KB
68 KB 19ms
18ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1112
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:36:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:36:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 4691602062959497009
tpc.googlesyndication.com/simgad/ Frame 4D15 45 KB
45 KB 49ms
7ms Image
image/jpeg 142.250.184.225
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4691602062959497009

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

685952ca8db3fc8fd55925ff916a4553638942a4ae799e2d2c82ed0e3854560d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 121340
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sat, 09 May 2026 22:12:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 09 May 2025 22:12:50 GMT
last-modified: Tue, 25 Mar 2025 21:42:41 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 46029
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 9634 0
0 48ms
48ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssxRC79w-mNe4WWVciv9k9s1Dmbc4gae0lHYNMA7VEZ4pdiSgIniQTlO56Mp9aBKJHsejlDI-BVymJogNVtFkj4jVcHtiZBcLI69HBzpVn0aprVdJ5qA1ldTfMf-n3Xjb_mrBuCIKfIWYafrKQAtvgy14WuOfH5i03jbeOzFP7hL54I7vgmeHwE4TM-O_pFx_jF-c9l8S2NH4beggrG9ppoUNF6oVN83g8MNocg0dLriBd_b1j1q3cu64HrhO349j9zAoASD-a2_UqPJxLLK_5CMC5m43MjtB6yEYW5kvYinGYKzw-RrZQtRxQTCUtOlcK2xByZ_1gqI0QTqSeUNDnLX3WhCi7u4eqM9sajBMehMdMw_1Hks8eI6kEfBEdk_-gQck8s_v1DYSLERA2whTTMAs9ppSnIAsXjxNl_opDmjTv0EgdTrafcXp2L-eKwKYBMaiIKvv6MG0mjkJdJ&sig=Cg0ArKJSzLPUvRHBTQzfEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame 9634 21 KB
0 28ms
28ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 49390
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame 9634 3 KB
0 31ms
31ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 49379
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9634 221 KB
0 15ms
15ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1112
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:36:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:36:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 17226142649961660359
tpc.googlesyndication.com/simgad/ Frame 9634 51 KB
51 KB 63ms
25ms Image
image/jpeg 142.250.184.225
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17226142649961660359

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

6b93bcb4dfb73d4005a866b024c24e35827c0728fbefff901bfddbbfefd8fda0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 121340
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sat, 09 May 2026 22:12:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 09 May 2025 22:12:50 GMT
last-modified: Tue, 25 Mar 2025 21:42:41 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 51845
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 26D0 0
0 45ms
44ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvWcT5hHE7Ne-muS3zSg3hW3q6oa8tln5QFLzqcKN8IRe6Ma20P0hHn4ugxm6pMUjvt4_Cqiq5qNJc_gAXh9AEpc-_eL8bvNKaQQAc_fSNiUd4mEHtJSGE0K4zb4TT_2bwwyQG8GdZl02Tc0c80Y3nTU_EEZJgfMuSshDJA9rhU-bVmOoOLXjwcPiG5_qtwqqCnh3ErZPTR9lO4NhpqgBj0DtlqjuJtbyeePxNJS_PrtVoST3EbO3RaZGFBZZm0ngh-1Wlo1CuXKipnNaupH6mfV_i17oRWkgJEf6yaeefSk9xzPYJFoVpWqxuWfn9Wv3bqR30be-bhDBeLHkDJk-9yFNcEb5Yrk11b75hkHXHItLYLL8ndYI7d5P5kjsNkELSxmEAYYtSirnxPqEbWFZ-3LrhYdk1Qbb04uvv0tLWB8w0E1zrNhRC22lawWxJOCSJfnFU8RFjIzQ&sig=Cg0ArKJSzPPjNaQWK17OEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame 26D0 21 KB
0 26ms
26ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 49390
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame 26D0 3 KB
0 31ms
31ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 49379
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 26D0 221 KB
0 11ms
11ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1112
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:36:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:36:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 11365875727166687852
tpc.googlesyndication.com/simgad/ Frame 26D0 99 KB
99 KB 56ms
22ms Image
image/jpeg 142.250.184.225
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11365875727166687852

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

04c7010a54c2c69a1b976febd24056bb6097d5c8dc31d1f64e1a42249926c38d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 137660
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sat, 09 May 2026 17:40:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 09 May 2025 17:40:50 GMT
last-modified: Thu, 01 May 2025 21:21:17 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 101106
x-xss-protection: 0
server: sffe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame E79C 0
0 40ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvujNd1K1V38qJH98rbkgQOgLMX4cqbvCV5vJwciNxPbm1oGiRSMhuexsRUNoTPBDVi0pTqo_I4nU-QoREHTy6UM8NAJf6p9p4Lp2QBKqyBmPFVBZIqtsay0q_6Hp_YMeHvBKajUQzF2UHHrYeqB06dYtul4MOVe_IU8w2gWKyYl52wQDSq_C3QVivb_5aOrJ7b2C2v7NHaxgookyZdvmwFfbr77_RQmQdqLQ2U5OJgI3nejcMUY5QUft31EQrcOddLr3FNIKCgT3Zb1TM0_ntxsamXcVxzChW9QgFYLK2DUgqTM8fc78cDjiHiagifQjc_dBQSwNTFYiWbd0lVucQmvXwLgZWustbQ9VUyb6quvQ-uPj2rFIidvY-_BWjFuRwc7ztqSwESMq-k7HS-CIYyY8-brSk4-9GjR1HsekPRU_mTuZeMaa6lZC0FR3BRq2U38v6CQ5mz8OmfixBeOlo&sig=Cg0ArKJSzEQ9xjs-1IF6EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame E79C 21 KB
0 22ms
22ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 49390
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame E79C 3 KB
0 26ms
26ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 49379
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E79C 221 KB
0 5ms
5ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1112
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:36:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:36:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H2 200 12899122967179447964
tpc.googlesyndication.com/simgad/ Frame E79C 49 KB
49 KB 43ms
16ms Image
image/png 142.250.184.225
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12899122967179447964

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

51a6ce669ce12679bc8f89ea5949c2007917727698ddaef180c47f4d7dbfa7cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 129297
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sat, 09 May 2026 20:00:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 09 May 2025 20:00:13 GMT
last-modified: Thu, 08 May 2025 16:10:02 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 49844
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 4D15 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d16f6737bf4c2018a4ec87665a3e6d5699cd9d6469e3ae793108aca6a7fe448b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9634 209 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b8e7e33f617e9e985d6e5ef4998381721e8cb0279f789b206cb0e58eac75913

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 26D0 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1961511f562aa5192c80e9b7922f3a9abd5c397372eff924c52842cd52d787d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E79C 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c681ddfcff5aec120ad5b731ab77494bfd2fae4c03f8bbaafc5e6fece11fb028

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 94ms
94ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlZW52IjoiaiIsImVwaWQiOiIvMTAwOTY0MS9TcG9rZXNtYW5EZXNrdG9wX1NpZGVSYWlsXzEwMHg1MjUiLCJyZW5kZXJlZCI6IjAifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=976a1fb3-8901-42b2-aa46-de95f5561bdb&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950110514&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5236&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:10 GMT
Content-Type: image/gif
Connection: keep-alive

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 18ms
17ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746950107706&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&cid=366061901.1746950108&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAAAAQ&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746950107&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&_s=3&tfd=2969
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/plain
server: Golfe2

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D15 0
0 39ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D15 0
0 39ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D15 0
0 38ms
38ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D0 0
0 59ms
38ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D0 0
0 60ms
37ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 26D0 0
0 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssNMwsi3dqnnlSHNZ--gSKYy8khwrQ1wGrgY74Ahklx8fAdhAeeQV-lWF_Yb8GldWxpOn6grCv9zGrqQNkGIp98aObVjA1c81R9q3NNbVjp0Oe4N9M7rW-UjccXSogZ2-aXH0d2eAELR8VBDJF6a5r2RcVSdiLecByBEjLONtpBLO50ICPqaY1STK8dK02Ut9xL5_nDxyEVx-zi7KEDp127DsWLF3iS9wHr1bWiUJ2CEA3KIRP-_4YMejqcc9anWixNKDPzsgrKiA1Pzj0yYOqVwEaup10jPBYP98KVqB3D9aFRuVVSzYw82fFQbVK0j0soJqELUp73b1XXBAb0vfG4tNtoLtycA8BA4wd-VVI4d-NFJ9d81U6p-kjhNfQS42OSV2YSmKNWXTVWuZQ-WZ46FtQyFlIVMCYbtbN7qyirmgv57dvr6Lo-LtsHBKAv5BMlm5WEByFDsVIE&sig=Cg0ArKJSzP8oiKb5VhGuEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26D0 0
0 60ms
38ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9634 0
0 84ms
37ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9634 0
0 86ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 9634 0
0 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsswLS2zukWT9Lcws4AfVJzyptWkDWlm3J2CavNLNa9a-43Mugj-0NRSCl_xxXloSPGl7pnDGKQ6yY5NgZ6ACn32s7ivDy1rfB0OXUqCPsJw5IhLGi1BogE0XRMoZCX9VkyQNeAcTsHCgOLnBFQziMTwTmaoKd3hHtR21eIPAZuXYYpFjk64AkLC4Y-BTTtdDoIt7_Mgvccz1sPj3qSSrkBovghST_OERI2IUdirVSkHnxD8hil8MN7dHk1V8SLDiHTqdpcSH-H1kMWyDNavF8QqiRHoykKMl2M-yUd85Cy3ivy7QgtTOr5NgrWAH9yh__0V252Rvf9vaV-tbtUK1lqJbbIESd7nIP9-fD4UeB6_JAkF4vZqIgRIlyxK-hdGTPdInwe_wqRI6wqRzxgkrzeQvN-zpyZet75FnuP5JJmG19I-RNqBZ4_8v3RZ-tLnOSiLio6td-UFtDQZ0ueXCqI&sig=Cg0ArKJSzIJ9gby6Lw8PEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9634 0
0 91ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E79C 0
0 113ms
37ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E79C 0
0 116ms
38ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame E79C 0
0 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsshyVABNqHIkd2lgEQps7qtgp8aolLyeK8k6Ri2QzbRRScLwMtLyrCol_cy7d0aE5YnI00pXkRvLQ2i9KHE0HPO1cKs5XZcQqL4ox2ZtnZC_GFWmnPunArlsf2P-0ChjunYSUuyusjo1B3IKULDxIhE2C1FnC3xLuBCwiqJ_KnnPcoBSoS68PIjyTdktVUpAwiGO9zpsccvaohWVyTV1xdJ3bAo1FtFMQqCzNcT2G96RSs49abCFoXEjQj45bjf5n1eYJIZ98hZWWM_uSo9mYkxQQyT_KhhOP8NaYR6WdHf4zY34IE3LXNVwbu2jwABoROirZcap67XyeNmK2OrDf_37Iy8pbTbEu2jZ1jc7eHga2dyBB-5QVzXBKZaZll2GitpfmJctM6JZGUHpgfVPdsZL8muj91zfwib_iNKKuHWk1eFqL5_wPQAGfTClgA4Hz8LXNUFmRok2RG2FOPIrkMjMg&sig=Cg0ArKJSzLwoA7tQE2vUEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E79C 0
0 120ms
38ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 4D15 0
0 40ms
40ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssDWahbkfPJLl2UVFO3JoWbWAinXIcRMnEFrGXKTQ9IeaEplCxgW1a9us9dk77xI49tYUtpjY_VCF6tEbE_NlnuiPf5ydznjME_lJQpFPXRC5n_LobN63rR2Kw552msrK9Ty9eECdyFDagxKdBgTTOkUynUByQa3bt3q8Gy4cpXqT_Oq3zOB-eYVkJzJyCfgCPFSkUNwOkbCaf0GRQ9SqdNcrwxg6r1XrkPvTZSZ9iN7EO67h8Fgb7u83SBwjzYoArcUABwjHGof6TOQ7FGvWbvvE8M5jEf_xb7P_vf0Lolk5GLs8WBvE0v-W6tCWUU-BZ4dI74gP0T6DlCT_9ZrYwB5EwzldMVHBSnllqO3sfS-BCnnZ-khvVVbHQzX_0nZQlxuKcj7UJ7TCg35Kp3Kzotz_z3VKyl-TiEu87nLT8j70ohUCFT37D1_f_BAyliwobtAwcw69R42DvkddNZCw&sig=Cg0ArKJSzJn8e-CbefErEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 93e01cc2bc952bb2 Show response
givebutter.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.33216633245225974:1746947422:jLHvUwd6yuX4XBRzPQX-vHP5ZD5Q_zuxK7ssbpSyj_E/ Frame 2F5F 0
487 B 30ms
25ms XHR
text/plain 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebutter.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.33216633245225974:1746947422:jLHvUwd6yuX4XBRzPQX-vHP5ZD5Q_zuxK7ssbpSyj_E/93e01cc2bc952bb2
Requested by: Host: givebutter.com
URL: https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cf-ray: 93e01ccfbad02bb2-FRA
content-length: 0
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 180ms
180ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk0Mjc1MjU0NCIsImVidXkiOiIzNzMwNDI1MzA2IiwiZWFkdiI6IjQ3Njc2MzU0MzEiLCJlY2lkIjoiMTM4NTExNjAzNjIzIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF83Mjh4OTAiLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=60eb7745-67af-4eb3-b71d-b8d789b94d93&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950110531&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5236&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:10 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 722ms
333ms Image
image/png 52.32.178.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2majczm50Qphu2N4a8R,7ZunmTSpYT&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,27b,0,1,1,1,1,1,5,5,5,5,1,0,0,0,0,5,5,5,5&b=I1,1C,1,2,:g3,4:,:s5:0,:h1:,:Q5t,1,2,:D2::&b=G0,1,:K6,:k7,8,9,a,b:c,:kd:e,:kf:g,:kh::,:Li,j,1,k,l:&b=Km,:kn:&b=Ii,1H,1,o,:g3,p:,:sq:1h,:h1:1,1,r,,r,:Q6t,1,4,q,s,t,u,v,u,v,:D,E,,1,,w,3B,0::,:c6I,:D,E,,1,,w,3B,0::&b=Km,:kx:&b=Ij,1K,1,y,:g3,z:,:sA,B:1j,:h1:1,3,r,:sB,A:r,:Q6u,1,6,A,s,t,C,v,C,v,:D,_1mH,_sM,1,,A,5u,Di::,:c6I,:D,_1mH,_sM,1,,A,5u,Di::&b=Km,:kD:&b=Ik,1I,1,E,:g3,F:,:sA:1l,:h1:1,6,r,,r,:Q6u,1,8,A,G,H,I,J,I,J,:D,,,5,b,A,jx,Di::,:c6J,:D,,,5,b,A,jx,Di::&b=Km,:kK:&b=Il,1G,1,L,:g3,M:,:sq:1m,:h1:1,7,r,,r,:Q6v,1,a,N,O,P,Q,R,Q,R,:D,,,5,NO,S,17a,ko::,:c6K,:D,,,5,NO,S,17a,ko::&b=Km,:kT:&bi=Ux8036RGIcSa0,adbridg_ad_adbdtsiderailros_1,1009641,SpokesmanDesktop_SideRail_100x525,100x525,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,Uga016RGIcSa1,U1s026RGIcSa2,Uu2046RGIcSa3,Uwd056RGIcSa4,pos,siderail_sponsorship,adbridg_ad_adbdtlbtop_1,SpokesmanDesktop_News_Top_728x90,728x90,0.05,5cEvLF,44su26,2rbSzwX,7zR55K,4000x101,lb_top,adbridg_ad_adbdtsiderailtop_1,SpokesmanDesktop_News_Top_300x250,300x250,300x600,2rbTafs,siderail_top,adbridg_ad_adbdtsiderailbottom_1,SpokesmanDesktop_News_Middle_300x250,5a3Upq,46CzGn,2rcaf9b,7CrEt0,siderail_bottom,adbridg_ad_adbdtbottomlb_1,SpokesmanDesktop_News_Footer_728x90,729x91,tZ0nx,42IxXh,2rcgm5d,7AoU5R,1472x91,lb_bottom&bt=uKScD6G&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.majczlwd.2T8f&g=2T2fr&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.41g.1.0&adbj=gbv3majczm34erm&mp=0.3&adb_cm=t5a&adb_flag=lrc&txx=Txx3&rnd=1746950110709
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.178.217 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-178-217.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 2 B
296 B 23ms
21ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01ccfffebd25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 2
date: Sun, 11 May 2025 07:55:10 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

POST
H2 204 rum Show response
givebutter.com/cdn-cgi/ Frame E2AE 0
181 B 16ms
15ms XHR
text/plain 104.20.37.218
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://givebutter.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.37.218 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 93e01cd07b212bb2-FRA
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 07:55:10 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 Matter-Regular.woff2
givebuttercdn.com/fonts/Matter/ Frame E2AE 31 KB
32 KB 20ms
20ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-Regular.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da83fbbef0baaca05320982fb4bee293959ec222e4683ded73a621ed24dae559

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "ef5fcfdb1c5008a6d178160610eb6380"
age: 2200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TgOtO9T4VHjt2Jb2q8P2LBflmuYVx6zK2e6ZWlF7e6%2FeJ%2B92UsmBiabA68%2FL4WjmK3Lgfm0cBHOD2QVbpvaEjEnEYeUxCX9n6HL1rZikAxnNIX5tBtqLfNouprM5nsQ2NCrA"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=6215&min_rtt=610&rtt_var=11014&sent=586&recv=264&lost=0&retrans=0&sent_bytes=754058&recv_bytes=3913&delivery_rate=287669333&cwnd=487&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=590&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:52 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93e01cd07e9f362f-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 31724
server: cloudflare

GET
H2 200 Matter-Medium.woff2
givebuttercdn.com/fonts/Matter/ Frame E2AE 31 KB
32 KB 18ms
17ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-Medium.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ac3677e23d988059a7f8ce54c455ff98cd2dbf163bf8bc1b6eaac75c838228d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "b2689cd318d2ca5904e48681eacda205"
age: 2872
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a6ql0Kym9TtSAdF3fac3VdLGLNMfyIXDcUqcYagoQdOpeUkHWQWZDLVaGeOhyPrWhQlu335x1POhD9Fu6ibDxUGs7uV1mB9dr58q37Z1ytjkP62I9oZ0lntj6kXmJ7pgs4Qe"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=6215&min_rtt=610&rtt_var=11014&sent=560&recv=264&lost=0&retrans=0&sent_bytes=721089&recv_bytes=3913&delivery_rate=287669333&cwnd=487&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=590&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:56 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93e01cd07ea0362f-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 32112
server: cloudflare

GET
H2 200 Matter-SemiBold.woff2
givebuttercdn.com/fonts/Matter/ Frame E2AE 32 KB
33 KB 30ms
30ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-SemiBold.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 856ca1ff9bf0886b1ca22ba2f59f0fe805be7dde4ed8e849a3aa2cb07d3f8cca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "efa5fe3e8fe23834c9d7c97eee4ca653"
age: 5704
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5lvsPt3zvIh2Oz6v%2FYZMbXvtQDYim1t37H6xv4%2B5JHjI9t1Eh%2BKUFKUgW3Ue3MzZEbbgDnp%2Fu0DYTUVikFlGGiXqDANtFmOblsaXbOruWSv6%2FYNSZwuGzL5GkRNi0B5iPMtv"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=1345&min_rtt=610&rtt_var=1308&sent=612&recv=280&lost=0&retrans=0&sent_bytes=786630&recv_bytes=4069&delivery_rate=287669333&cwnd=487&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=602&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:55 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93e01cd09eb7362f-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 32420
server: cloudflare

GET
H2 200 Matter-SemiBoldItalic.woff2
givebuttercdn.com/fonts/Matter/ Frame E2AE 33 KB
34 KB 36ms
35ms Font
font/woff2 104.26.2.180
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://givebuttercdn.com/fonts/Matter/Matter-SemiBoldItalic.woff2
Requested by: Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.180 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0ee583ec077fde22c36c75a03d7c8e2bc82a78d6c11519e6178770132822260

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebuttercdn.com/apps/prod/build/main.DDE89l1r.1.0.0.css

Response headers

cf-cache-status: HIT
etag: "db8707a98531c8385f3bcc5185fd9cd1"
age: 2187
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=koZeJysNyQmQeE6Rd%2Fm4N4HY%2FgNSLTali6eQ%2BNFrhNjQPokzwh06Z5QMFgBxjbynBTGGgCAThv9kGB6kNnl2ed5VLAa%2Bj4fRXnf%2B6%2BjpXTy5Ut7VXsZ7Ly9EwNI%2FqzvnJp6c"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=2131&min_rtt=610&rtt_var=2595&sent=638&recv=284&lost=0&retrans=0&sent_bytes=820048&recv_bytes=4069&delivery_rate=287669333&cwnd=487&unsent_bytes=0&cid=e6aa22f28eac55a3&ts=607&x=0"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: font/woff2
last-modified: Wed, 31 Aug 2022 20:02:54 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93e01cd09eb8362f-FRA
accept-ranges: bytes
access-control-allow-origin: https://givebutter.com
content-length: 33764
server: cloudflare

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 94ms
94ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk0Mjc1MjU0NCIsImVidXkiOiIzNzMwNDI1MzA2IiwiZWFkdiI6IjQ3Njc2MzU0MzEiLCJlY2lkIjoiMTM4NTExNzQ0NzY2IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF8zMDB4MjUwIiwic2l6ZSI6IjMwMHgyNTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=18cbb016-56c6-4a9a-91b3-514d43f8a6a5&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950110532&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5236&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:10 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2 200 recorder.js Show response
ph.givebutter.com/static/ Frame E2AE 110 KB
40 KB 295ms
295ms Script
text/javascript 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/static/recorder.js?v=1.212.1

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

bdb9c31c82af189d8c6c851298ea91b1be792ae1745172232a9fe6b41499025d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=60, public
cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 4
referrer-policy: same-origin
x-content-type-options: nosniff
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:11 GMT
content-type: text/javascript; charset="utf-8"
vary: Accept-Encoding, Origin
server: envoy
last-modified: Sat, 10 May 2025 23:20:19 GMT

GET
H2 200 dead-clicks-autocapture.js Show response
ph.givebutter.com/static/ Frame E2AE 12 KB
5 KB 212ms
212ms Script
text/javascript 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/static/dead-clicks-autocapture.js?v=1.212.1

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

eceea9ec229684ba339474ad50f60f0c8b08706c4e2bff6a7018d0f8eab579af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://givebutter.com
Referer: https://givebutter.com/

Response headers

cache-control: max-age=60, public
cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 2
referrer-policy: same-origin
x-content-type-options: nosniff
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:11 GMT
content-type: text/javascript; charset="utf-8"
vary: Accept-Encoding, Origin
server: envoy
last-modified: Sat, 10 May 2025 23:20:19 GMT

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 29ms
29ms XHR
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 858544025436389643
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:10 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52326
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-woff2

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.spokesman.com
Referer

Response headers

Content-Type: application/x-font-woff2;charset=utf-8

GET
H/1.1 200
OK 100013SR-logo-letters.png
prodmg2.blob.core.windows.net/connext/upload_images/ 14 KB
14 KB 551ms
192ms Image
image/png 20.60.62.4
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://prodmg2.blob.core.windows.net/connext/upload_images/100013SR-logo-letters.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.60.62.4 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f5a01f79f64d5b9ef018f69222a4b31357301ca04ed99ef802ad95e753c9a17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-ms-blob-committed-block-count: 1
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
ETag: 0x8DBBE09D315BF2A
x-ms-request-id: cdca8e46-901e-008a-764a-c2ac0f000000
Access-Control-Allow-Origin: *
Content-Length: 14041
Date: Sun, 11 May 2025 07:55:10 GMT
Content-Type: image/png
Last-Modified: Mon, 25 Sep 2023 20:56:00 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: AppendBlob

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 180ms
180ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk4MTAyMTAwNiIsImVidXkiOiIzNzYyMzgyOTc1IiwiZWFkdiI6IjQ3MjkzNTkzNDQiLCJlY2lkIjoiMTM4NTE1ODE1MTczIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX01pZGRsZV8zMDB4MjUwIiwic2l6ZSI6IjMwMHgyNTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=2c354710-f156-4cfc-9f4a-0671a5f5ffda&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950110533&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5236&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK mc-validate.js Show response
s3.amazonaws.com/downloads.mailchimp.com/js/ 140 KB
140 KB 416ms
207ms Script
application/javascript 3.5.16.95
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.5.16.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: s3.us-east-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b15aceb04dbf5604df5617cfe984f48479cb131c1df02825d1c24e9f35d01857

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: public,max-age=2592000
ETag: "6465dd4a8331265e6629cd069e03504c"
x-amz-request-id: RTCAYFPYNMDM0TYM
Accept-Ranges: bytes
Content-Length: 143249
Date: Sun, 11 May 2025 07:55:12 GMT
Last-Modified: Mon, 20 Aug 2018 17:42:38 GMT
Content-Type: application/javascript
Server: AmazonS3
x-amz-id-2: p2UltTtYRMcu3rCzAshdAeRRK9ldq9pe2IsgoLt7oRuycg80BlJIbIXFstRIz/WOtrH1PMo284GLU065trqHHavd35EHHRdI

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 37ms
36ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 180ms
179ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk1MDgxMzQxOSIsImVidXkiOiIzNzA0NzAwOTU5IiwiZWFkdiI6IjQ0MzA1MzIxMSIsImVjaWQiOiIxMzg1MTcyNzE4MDMiLCJlZW52IjoiaiIsImVwaWQiOiIvMTAwOTY0MS9TcG9rZXNtYW5EZXNrdG9wX05ld3NfRm9vdGVyXzcyOHg5MCIsInNpemUiOiI3Mjl4OTEiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=ede60ef3-a03d-4de8-8db8-f14d82bfd285&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950110535&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5236&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 202ms
202ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&metered=1%7C2&metername=First%20Time%20Visitor%20-%20REG%20Wall&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=077a00dc-1ff7-4015-bd00-f553a0e0b9e4&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950111107&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5407&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwNDEiLCJuYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwib3JkZXIiOiIxIn0sImFjdGlvbiI6eyJuYW1lIjoiRlRWX1JXIC0gQmFubmVyIC0gMXN0IEFydGljbGUiLCJ0eXBlSWQiOiIxIiwidHlwZU5hbWUiOiJiYW5uZXIiLCJvcmRlciI6IjE3In19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjM2NjA2MTkwMSIsInJlZlRpbWUiOiIxNzQ2OTUwMTExMTA3In0seyJ0eXBlIjoibWcyIiwiaWQiOiIyNTYxZmIwMDE2ZmMzMmFiYzFiMzlmNjU1ZDRkMWQwYiIsInJlZlRpbWUiOiIxNzQ2OTUwMTExMTAxIn1dLCJtZzJEYXRhIjp7InZlcnNpb24iOiJWZXJzaW9uOiAyLjguNy4xIiwiZW52aXJvbm1lbnQiOiJwcm9kIiwiYXV0aFN5c3RlbSI6IkF1dGgwVW5pdmVyc2FsTG9naW4iLCJjYW1wYWlnbk5hbWUiOiJUaGUgU3Bva2VzbWFuLVJldmlldyBDYW1wYWlnbiBDb3B5IiwiY2FtcGFpZ25JZCI6IjEwMDA0MSIsInN1YnNjcmlwdGlvbnMiOltdLCJjb252ZXJzYXRpb24iOnsiSWQiOiIxMDAxNTIiLCJDb2RlIjoiRlRWX1JXIiwiTmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwiT3JkZXIiOiIxIiwiUHJvcGVydGllcyI6eyJQYXl3YWxsTGltaXQiOiIyIiwiVmlld3MiOiIxIiwiRGF0ZSI6eyJFeHBpcmF0aW9uIjoiMjAyNS0wNS0xMlQwNzo1NToxMS4wMjRaIiwiU3RhcnRlZCI6IjIwMjUtMDUtMTFUMDc6NTU6MTEuMDI0WiJ9LCJBcnRpY2xlTGVmdCI6IjEiLCJWaWV3VHlwZSI6IkNvbnZlcnNhdGlvbiIsIlBheXdhbGxJbmZvIjp7IkFydGljbGVMZWZ0Ijp7IkNvbnZlcnNhdGlvbiI6IjEiLCJNZXRlciI6InVubGltaXRlZCJ9LCJMaW1pdCI6eyJDb252ZXJzYXRpb24iOiIyIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTWluVmlldyI6IkNvbnZlcnNhdGlvbiJ9fX19LCJ1c2VyRGF0YSI6eyJtZzJEYXRhIjp7Ik93bmVkU3Vic2NyaXB0aW9ucyI6W10sIkF1dGhTeXN0ZW0iOiJBdXRoMFVuaXZlcnNhbExvZ2luIiwiRGlnaXRhbEFjY2VzcyI6eyJBY2Nlc3NMZXZlbCI6e30sIlN1YnNjcmlwdGlvbiI6W119LCJJZ21SZWdJRCI6bnVsbCwiRW1haWwiOiIiLCJOendMaWQiOm51bGwsIk1hc3RlcklkIjpudWxsLCJEaXNwbGF5TmFtZSI6IiIsIkVtYWlsUHJlZmVyZW5jZXMiOm51bGwsIkFkZERhdGUiOm51bGx9fX0
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 202ms
202ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&metered=1%7C2&metername=First%20Time%20Visitor%20-%20REG%20Wall&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=93a42282-f92e-4a24-83be-22ebf1fa2f8e&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950111200&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5407&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiaW5saW5lIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwNDEiLCJuYW1lIjoiVGhlIFNwb2tlc21hbi1SZXZpZXcgQ2FtcGFpZ24gQ29weSJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwib3JkZXIiOiIxIn0sImFjdGlvbiI6eyJuYW1lIjoiRlRWX1JXIC0gRVZFTklORyBFRElUSU9OIiwidHlwZUlkIjoiNCIsInR5cGVOYW1lIjoiaW5saW5lIiwib3JkZXIiOiI1In19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjM2NjA2MTkwMSIsInJlZlRpbWUiOiIxNzQ2OTUwMTExMjAwIn0seyJ0eXBlIjoibWcyIiwiaWQiOiIyNTYxZmIwMDE2ZmMzMmFiYzFiMzlmNjU1ZDRkMWQwYiIsInJlZlRpbWUiOiIxNzQ2OTUwMTExMTk1In1dLCJtZzJEYXRhIjp7InZlcnNpb24iOiJWZXJzaW9uOiAyLjguNy4xIiwiZW52aXJvbm1lbnQiOiJwcm9kIiwiYXV0aFN5c3RlbSI6IkF1dGgwVW5pdmVyc2FsTG9naW4iLCJjYW1wYWlnbk5hbWUiOiJUaGUgU3Bva2VzbWFuLVJldmlldyBDYW1wYWlnbiBDb3B5IiwiY2FtcGFpZ25JZCI6IjEwMDA0MSIsInN1YnNjcmlwdGlvbnMiOltdLCJjb252ZXJzYXRpb24iOnsiSWQiOiIxMDAxNTIiLCJDb2RlIjoiRlRWX1JXIiwiTmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIFJFRyBXYWxsIiwiT3JkZXIiOiIxIiwiUHJvcGVydGllcyI6eyJQYXl3YWxsTGltaXQiOiIyIiwiVmlld3MiOiIxIiwiRGF0ZSI6eyJFeHBpcmF0aW9uIjoiMjAyNS0wNS0xMlQwNzo1NToxMS4wMjRaIiwiU3RhcnRlZCI6IjIwMjUtMDUtMTFUMDc6NTU6MTEuMDI0WiJ9LCJBcnRpY2xlTGVmdCI6IjEiLCJWaWV3VHlwZSI6IkNvbnZlcnNhdGlvbiIsIlBheXdhbGxJbmZvIjp7IkFydGljbGVMZWZ0Ijp7IkNvbnZlcnNhdGlvbiI6IjEiLCJNZXRlciI6InVubGltaXRlZCJ9LCJMaW1pdCI6eyJDb252ZXJzYXRpb24iOiIyIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTWluVmlldyI6IkNvbnZlcnNhdGlvbiJ9fX19LCJ1c2VyRGF0YSI6eyJtZzJEYXRhIjp7Ik93bmVkU3Vic2NyaXB0aW9ucyI6W10sIkF1dGhTeXN0ZW0iOiJBdXRoMFVuaXZlcnNhbExvZ2luIiwiRGlnaXRhbEFjY2VzcyI6eyJBY2Nlc3NMZXZlbCI6e30sIlN1YnNjcmlwdGlvbiI6W119LCJJZ21SZWdJRCI6bnVsbCwiRW1haWwiOiIiLCJOendMaWQiOm51bGwsIk1hc3RlcklkIjpudWxsLCJEaXNwbGF5TmFtZSI6IiIsIkVtYWlsUHJlZmVyZW5jZXMiOm51bGwsIkFkZERhdGUiOm51bGx9fX0
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET flyertown_module.js
api.circularhub.com/2871/48979fe04f6431c3/ 0
0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 71ms
27ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202505060101&st=env

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

049f3bd130a52e47649eaf5ea920d08413199dd3fb528672b702d6bffac1ab7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13313
date: Sun, 11 May 2025 07:55:11 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET atrk.js
d31qbv1cthcecs.cloudfront.net/ 0
0

GET aam.js
aamcftag.aamsitecertifier.com/ 0
0

GET
H2 200 load_tags.js Show response
pymx5.com/scripts/ 9 KB
9 KB 44ms
9ms Script
application/javascript 35.227.203.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pymx5.com/scripts/load_tags.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.203.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.203.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=xz4nKQ==, md5=9rBmlHZ+cHmZ7svpU4tAOg==
etag: "f6b06694767e707999eecbe9538b403a"
age: 2316
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 8946
date: Sun, 11 May 2025 07:16:35 GMT
last-modified: Fri, 15 Jul 2022 06:19:11 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwpavdejJGqVESz8Wgwy3SDzCPOpbu0AVqfWlV1Z3UMwVTwTNHZ-hQ9kpENwUUVXCy2I
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1657865951655064
content-length: 8946
server: UploadServer

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 272 KB
69 KB 15ms
7ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

d077807b2373375b2d5c8ffbfeeea0bcb152e29c21ec147aecfab6b5502e5463

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;script-src data: 'nonce-qvECUdLE' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;img-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;media-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;child-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;frame-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;manifest-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;object-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;worker-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:11 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src data: 'nonce-qvECUdLE' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=23, mss=1232, tbw=4815, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: Tln7YabDufsM9gcDuLpqjqxJ0cAhm9KDCQ/Z6byM0Qw2CPNADMQRKHUcVI3R5qNRROPOOvt2Xvj4dpAXqr3z+w==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-qvECUdLE' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' data:;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 70067
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 collect
www.google-analytics.com/ 35 B
58 B 18ms
18ms Image
image/gif 142.250.185.142
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=366441399&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&ul=de-de&de=UTF-8&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&el=10%25&_u=aCDAiUABBAAAAGACIAC~&jid=&gjid=&cid=366061901.1746950108&tid=UA-230256-14&_gid=2142407574.1746950108&gtm=45He5571n715P9SH6v71896582za200&cd1=Maria%20Cheng%20and%20Al-Hadji%20Kudra%20Maliro&cd2=nation-world&cd5=2021-09-28&cd7=News&cd8=979335&cd9=story&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&npa=1&z=1910985452

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 30830
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 23:21:21 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H2 200 favicon.09caecb42e62.ico
static.spokesman.com/sites/spokesman/img/favicons/ 15 KB
15 KB 15ms
15ms Other
image/vnd.microsoft.icon 3.161.82.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.spokesman.com/sites/spokesman/img/favicons/favicon.09caecb42e62.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-35.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c78493afeeaa3ff629bf1327b46b6432e8e3bb1c8e05f7c890cb486fca7d5538

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=31536000,public
etag: "09caecb42e620f10cd466b59cca951de"
age: 17221431
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 15086
x-amz-cf-id: 9wLNP3NMIga6rL_d1RmIMEl9mipwI3clMsYUuECOXRnnumR2kOBoEQ==
date: Thu, 24 Oct 2024 00:11:21 GMT
content-type: image/vnd.microsoft.icon
last-modified: Mon, 21 Oct 2024 23:52:28 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256

OPTIONS
H2 204 track
dc.services.visualstudio.com/v2/ Frame 0
0 298ms
60ms Preflight 20.50.88.233
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.233 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context,X-Set-Cross-Origin-Resource-Policy,Content-Encoding
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
date: Sun, 11 May 2025 07:55:12 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

POST
H2 206 track Show response
dc.services.visualstudio.com/v2/ 801 B
905 B 30ms
25ms XHR
application/json 20.50.88.233
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.233 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

c183d139162d5bb93065e4de0dbba9f4d713764fb9589e61d62dbb5f1a682a61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Sdk-Context: appId

Response headers

strict-transport-security: max-age=31536000
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json; charset=utf-8
server: Microsoft-HTTPAPI/2.0
x-content-type-options: nosniff

GET
H3 200 260139058256176 Show response
connect.facebook.net/signals/config/ 71 KB
14 KB 100ms
99ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/260139058256176?v=2.9.201&r=stable&domain=www.spokesman.com&hme=9ebdfdd473ffce6bfe2267012c83f73483198ffe20d84139a2066b7682f827c0&ex_m=73%2C128%2C113%2C117%2C64%2C6%2C106%2C72%2C19%2C100%2C92%2C54%2C57%2C181%2C202%2C209%2C205%2C206%2C208%2C32%2C107%2C56%2C80%2C207%2C176%2C179%2C203%2C204%2C189%2C139%2C44%2C194%2C191%2C192%2C37%2C151%2C18%2C53%2C198%2C197%2C141%2C21%2C43%2C2%2C46%2C68%2C69%2C70%2C74%2C96%2C20%2C17%2C99%2C95%2C94%2C114%2C55%2C116%2C42%2C115%2C33%2C97%2C29%2C177%2C180%2C148%2C14%2C15%2C16%2C8%2C9%2C28%2C25%2C26%2C60%2C65%2C67%2C78%2C105%2C108%2C30%2C79%2C12%2C10%2C83%2C51%2C24%2C110%2C109%2C111%2C102%2C13%2C23%2C4%2C41%2C77%2C22%2C160%2C89%2C135%2C76%2C1%2C98%2C59%2C87%2C36%2C31%2C85%2C86%2C91%2C40%2C7%2C93%2C84%2C47%2C35%2C38%2C0%2C71%2C118%2C90%2C5%2C50%2C49%2C101%2C88%2C246%2C174%2C126%2C163%2C156%2C3%2C39%2C66%2C45%2C112%2C48%2C82%2C63%2C62%2C34%2C103%2C61%2C58%2C52%2C81%2C75%2C27%2C104%2C11%2C119

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

48a815ebcf46dd19a6240a60e2f17fc5c99461989428b87471f8cc82534dd871

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;script-src data: 'nonce-KsMlpXGy' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;img-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;media-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;child-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;frame-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;manifest-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;object-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;worker-src 'self' data: blob: facebook.net .facebook.net facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src data: 'nonce-KsMlpXGy' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=85, mss=1232, tbw=81319, tp=76, tpl=0, uplat=92, ullat=0
pragma: public
x-fb-debug: +4atFjonRLLJ/3/vpj4E7WU+MDKXFO7Dcd4ssXcRK2Af43DeUVNyXEQnEoMZl3nbacznZUtvE9b+zdeHctEKoA==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-KsMlpXGy' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' data:;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET load_optional_tags
api.pymx5.com/v1/sites/ 0
0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 55ms
18ms Script
text/javascript 142.250.185.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f1.1e100.net

Software

sffe /

Resource Hash

f2c50a16459c96e45c44e339dba2764807e8c3a174cdd8804f3fbee6a6b19198

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "1746579216026011"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:12 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6641
x-xss-protection: 0
server: sffe

POST
H2 200 v1 Show response
prg.smartadserver.com/prebid/ 196 B
441 B 81ms
81ms Fetch
application/json 89.149.193.80
LEASEWEB-NL-AMS-0...

General

Check archive.org

Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.193.80 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software: /
Resource Hash: dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache,no-store
content-encoding: br
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 11 May 2025 07:55:11 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Origin

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 181 B
508 B 56ms
55ms Fetch
application/json 34.1.1.166
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&PageReferrer=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&CanonicalUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.1.1.166 Paris, France, ASN15169 (GOOGLE, US),
Reverse DNS: 166.1.1.34.bc.googleusercontent.com
Software: fasthttp /
Resource Hash: 06505bb1af78b8d1ae281cb611b4ab2c733bd9ece50bc32c535c950b9f913811

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-max-age: 3600
content-encoding: br
x-kong-request-id: 5e31670c7d989f038cf1362fe14ccf28
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS, POST
via: kong/3.6.1
x-kong-upstream-latency: 39
access-control-allow-origin: https://www.spokesman.com
x-kong-proxy-latency: 0
date: Sun, 11 May 2025 07:55:11 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: fasthttp
access-control-allow-headers: Accept-Encoding, Content-Type

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 214 B
534 B 59ms
58ms Fetch
application/json 64.158.223.146
VCLK-EU-SE Conver...

General

Check archive.org

Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.158.223.146 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE Conversant LLC, US),
Reverse DNS: ams02-convex-float1.dotomi.com
Software: nginx /
Resource Hash: 95f80d6fda95841abad766cfdeb5a8f8253617c94dd833f025add9796c712489

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-cache
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.spokesman.com
content-length: 214
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
server: nginx

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 140 B
706 B 54ms
53ms Fetch
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e5b90cb9b70eb820dae848b31c7541836b44c6356ed5b3985379c445340c1b1a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 149.88.19.250; 149.88.19.250; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
an-x-request-uuid: 4b1d6caf-1856-4865-8c5e-751757fc26a2
content-length: 140
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 204 68122574104a3c626f0165c9 Show response
exchange.kueezrtb.com/prebid/multi/ 0
40 B 214ms
213ms Fetch 143.244.200.230
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.kueezrtb.com/prebid/multi/68122574104a3c626f0165c9
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.244.200.230 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sun, 11 May 2025 07:55:12 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 83 B
471 B 66ms
65ms Fetch
application/json 34.247.115.141
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.247.115.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-247-115-141.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 366642ee1b00ba222c70283fb41feaece3718858063e2e99164366ff8adce61b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.spokesman.com
content-length: 108
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
44 B 85ms
84ms Fetch 163.5.194.36
SECUREDSERVERS-EU...

General

Check archive.org

Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 163.5.194.36 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU PHOENIX NAP, LLC., US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, private, must-revalidate
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:12 GMT
x-envoy-upstream-service-time: 64
vary: origin, accept-encoding, Accept-Encoding
server: envoy
access-control-allow-credentials: true

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
491 B 66ms
65ms Fetch 178.250.1.38
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.26.0&cb=97603630880&lsavail=1&networkId=12005

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.38 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
observe-browsing-topics: ?1
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:11 GMT
vary: Origin
server: Kestrel

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
124 B 66ms
52ms Fetch 3.72.6.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.72.6.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-6-211.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
741 B 87ms
85ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU57RW71
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 73c98920f05b2af9793c598970d1082b7c3a739ffea83dc981ecd550a25f93f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time: 69
access-control-allow-credentials: true
via: 1.1 google
expires: Sun, 11 May 2025 07:55:12 GMT
access-control-allow-origin: https://www.spokesman.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 552
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json;charset=utf-8
server: envoy

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
627 B 40ms
38ms Fetch
application/json 52.222.136.19
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.136.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-136-19.fra50.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 3a023c645ddb158b4c10efe2492281ec830314c76c52d95acdc89e3a70227755

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 f353b9615396320dcfec689a26cf519e.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.spokesman.com
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: RorgOjoTxK0bUzMyp0kk7WEI00suwDC5SChEZ8uOeUj2-8pCxmX9Hw==
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json
x-amz-cf-pop: FRA50-P2
server: istio-envoy
x-reason: maxmind anonymous vpn
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 adreq Show response
ads.servenobid.com/ 549 B
719 B 65ms
64ms Fetch
application/json 143.244.197.139
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL

https://ads.servenobid.com/adreq?cb=10352

Requested by

Host: prod.adspsp.com
URL: https://prod.adspsp.com/adb.4364783.pb.js?c=Cx33bcf6f:mafk1c8u:16

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

143.244.197.139 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Resource Hash

d99c12972bba3b40b8358fac2265585dd5d677da8db81b8f9475d6120fad3c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
access-control-allow-credentials: true
amp-access-control-allow-source-origin: *
access-control-allow-origin: https://www.spokesman.com
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json
vary: accept-encoding

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/235/ Frame CD92 13 KB
5 KB 32ms
7ms Document
text/html 142.250.185.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f1.1e100.net

Software

sffe /

Resource Hash

59269992b50afa23926326e86714ae0e9507488992fe1975361422662ee6a2ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1194
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 11 May 2025 07:35:18 GMT
expires: Sun, 11 May 2025 08:25:18 GMT
last-modified: Thu, 24 Apr 2025 23:13:28 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 80ms
70ms Fetch
image/png 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=260139058256176

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/260139058256176?v=2.9.201&r=stable&domain=www.spokesman.com&hme=9ebdfdd473ffce6bfe2267012c83f73483198ffe20d84139a2066b7682f827c0&ex_m=73%2C128%2C113%2C117%2C64%2C6%2C106%2C72%2C19%2C100%2C92%2C54%2C57%2C181%2C202%2C209%2C205%2C206%2C208%2C32%2C107%2C56%2C80%2C207%2C176%2C179%2C203%2C204%2C189%2C139%2C44%2C194%2C191%2C192%2C37%2C151%2C18%2C53%2C198%2C197%2C141%2C21%2C43%2C2%2C46%2C68%2C69%2C70%2C74%2C96%2C20%2C17%2C99%2C95%2C94%2C114%2C55%2C116%2C42%2C115%2C33%2C97%2C29%2C177%2C180%2C148%2C14%2C15%2C16%2C8%2C9%2C28%2C25%2C26%2C60%2C65%2C67%2C78%2C105%2C108%2C30%2C79%2C12%2C10%2C83%2C51%2C24%2C110%2C109%2C111%2C102%2C13%2C23%2C4%2C41%2C77%2C22%2C160%2C89%2C135%2C76%2C1%2C98%2C59%2C87%2C36%2C31%2C85%2C86%2C91%2C40%2C7%2C93%2C84%2C47%2C35%2C38%2C0%2C71%2C118%2C90%2C5%2C50%2C49%2C101%2C88%2C246%2C174%2C126%2C163%2C156%2C3%2C39%2C66%2C45%2C112%2C48%2C82%2C63%2C62%2C34%2C103%2C61%2C58%2C52%2C81%2C75%2C27%2C104%2C11%2C119

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-QaLJ4dE0' blob: data: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .fb.com .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7503093600714971749&cpp=C3&cv=1022726310&st=1746950112137"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:12 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: YrHB0qKu6hw4wYTKV5FAttNWyZAcJgACNOa1ZlbEwa+kW1Xi2P5709hg/CZjg3gwOYdF7X5BeKQhQ61dZqNkVA==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7503093600714971749&cpp=C3&cv=1022726310&st=1746950112137", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-QaLJ4dE0' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.fb.com *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=24, mss=1232, tbw=5108, tp=11, tpl=0, uplat=63, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 17ms
8ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=260139058256176&ev=PageView&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&rl=&if=false&ts=1746950112100&sw=1600&sh=1200&v=2.9.201&r=stable&ec=0&o=4126&fbp=fb.1.1746950112099.408908636602657574&cs_est=true&ler=empty&cdl=API_unavailable&it=1746950111991&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4591, tp=9, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
196 B 171ms
162ms Image
image/png 157.240.251.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=260139058256176&ev=PageView&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&rl=&if=false&ts=1746950112100&sw=1600&sh=1200&v=2.9.201&r=stable&ec=0&o=4126&fbp=fb.1.1746950112099.408908636602657574&cs_est=true&ler=empty&cdl=API_unavailable&it=1746950111991&coo=false&rqm=FGET

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net 127.0.0.1: 'nonce-BzJzk2qu' blob: data: 'self' 'wasm-unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com .fb.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .fb.com .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7503093600440099916&cpp=C3&cv=1022726310&st=1746950112133"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 11 May 2025 07:55:12 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: CzXFDGvmY7AgWil/7R7xWAUFojrm+jSW6xl29IFbCDTXwsztrhPRvK81Ug0HB4wD5V5HRkdtndRnkbPLhIIoHg==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7503093600440099916&cpp=C3&cv=1022726310&st=1746950112133", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-BzJzk2qu' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.fb.com *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=24, mss=1232, tbw=5231, tp=13, tpl=0, uplat=154, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 C3gPgfk95Q-1j-vDj2w_zIjbG_OdE7sxb7_7Q4j3DXI.js Show response
pagead2.googlesyndication.com/bg/ Frame CD92 54 KB
21 KB 24ms
7ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C3gPgfk95Q-1j-vDj2w_zIjbG_OdE7sxb7_7Q4j3DXI.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

sffe /

Resource Hash

0b780f81f93de50fb58febc38f6c3fcc88db1bf39d13bb316fbffb4388f70d72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 74610
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 11:11:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 11:11:42 GMT
last-modified: Mon, 05 May 2025 10:08:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21095
x-xss-protection: 0
server: sffe

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame CD92 0
40 B 6ms
6ms Image
text/plain 142.250.185.161
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?JgfepA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.161 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
cross-origin-resource-policy: cross-origin

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 64 KB
25 KB 104ms
104ms Fetch
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3745048750418345&correlator=4430649177418301&eid=31086814%2C31092333%2C83321072%2C31086810&output=ldjh&gdfp_req=1&vrg=202505060101&ptt=17&impl=fifs&iu_parts=1009641%2CSpokesmanDesktop_ROS_Catfish_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=6&dids=adb-dt-anchor-slot&adfs=3453142769&sfv=1-0-44&fsbs=1&eri=1&sc=1&abxe=1&dt=1746950112292&lmt=1746950112&adxs=436&adys=2200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=6&oid=2&u_his=1&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vis=1&psz=728x0&msz=728x0&fws=1028&ohw=1600&psts=AOrYGslu88PDz4L955Y-l2drupmYzn-jIHo9Hb72BpDU6W5eRZkCFd0uwgaMxpdlN6biZeOF5JG-t4dTOg%2CAOrYGsnnvfBz-ijoPKpJ2LEmelZ0E_M_1fUFKZiAbxTWykj8XzBiKWqL7yy4pgMGQTX51DheIh4aDx3DJg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslnY5oOk3rXfQUaEWXdw47KJzdlQfWkHpRCLAWnwHpIPh2QiVOp4Qx32Kgkzc-WKqh8osmQkaDGzA%2CAOrYGskIZyTApGWWuMxuxgNhzmFbD0HAypDOyv_Pmnu57HhWhAedaCieSSIryxLtvasNNeDHKXTB9rd7BA&topics=5&tps=5&htps=5&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1746950107601&idt=280&prev_scp=pos%3Dsticky_footer%26adb_imp%3DS88.6%2C1%2Clzs_dt%26adb_bdr%3Dnone&cust_params=tags%3Debola%2520outbreak%252Csex%2520abuse%252Cworld%2520health%2520organization%252Ccongo%252Cunited%2520nations%26section%3DNews%26category%3Dnation-world%26adb_pvd%3Dt5a&adks=2659927189&frm=20&eo_id_str=ID%3Dde8460169090cdf7%3AT%3D1746950110%3ART%3D1746950110%3AS%3DAA-AfjZuyN5TMz0JqJCiZLxxCCZZ&gblpids=%2F1009641%2FSpokesmanDesktop_ROS_Catfish_728x90&pbbce=1&td=1&egid=50433&tan=2ad740d0-feb8-45e6-ab29-6e881fa46fce&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

8f5caeedfcf4bf5de497608add8409bb627cf4c1923c82e76de906cdd3ed5c0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: 6950813419
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:12 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138517271809
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.spokesman.com
content-length: 25061
x-xss-protection: 0
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 14EE 0
0 39ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsueIUArVwg-Nm2AEhvgc0aSv0Trk3blg4mcosJ09dxMvIBSPh0uY1PE4tkkwLSBILtO_3U2QtKFfSzaq2Kg4V13jmdH1umbz7Gf2ggLnDPmCXKuI_ZqqhavOaTmskr_k8WpUx-04Fza0ZmZNQckYCnTG_RM2v8nlN9bIRABbvHDGU-Ilj-Nc3kUlBR4amwnOxBLm3JHFASxO0-pVSC6_Ix2FWhMxQLcLU_zaPyQIKyUV_jFqynq4asLlGP23WxkZ1AnGnSnSDCP3JoXOU-qukHRc_2e79cTVSnkdjTfcpgGf7YsKBhgK7MzzuQAfYcUlgaxJc35yHNTo3TV30x1m4s_on_9WvH9O1qC4NU7zrUWVOzIMylIWssxnaXumFeBUqFCYhnV-9hQReDxrJgwSleKcC6fFcSaPuklZAv308ahfuou3uLAYnFXH2DZ9Q1KVBho9mT-BK4bvFh65QyMTps&sig=Cg0ArKJSzP7hKy9jEDbZEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/ Frame 14EE 21 KB
0 22ms
22ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10699792191238367460
age: 49390
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8531
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/ Frame 14EE 3 KB
0 26ms
26ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250507/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 14145566667870440924
age: 49379
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:12:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 10 May 2025 18:12:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1239
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 14EE 221 KB
0 5ms
5ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6331052821066091214
age: 1112
x-content-type-options: nosniff
expires: Sun, 11 May 2025 08:36:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:36:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69463
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14EE 0
0 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14EE 0
0 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 6026525309595591990
tpc.googlesyndication.com/simgad/ Frame 14EE 47 KB
47 KB 8ms
7ms Image
image/png 142.250.184.225
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6026525309595591990

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

24469dde41b86409cc63a244b88b37dc5acd6f9823c59a63084a9a5311d43d90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

age: 86669
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 07:50:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 10 May 2025 07:50:43 GMT
last-modified: Thu, 08 May 2025 16:10:02 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 47940
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14EE 0
0 39ms
39ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWgD

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 14EE 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9acaa1c96a86c79f5c628de318c6a95d4645946bb59e5b0f6663369ceee8c605

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 115ms
115ms Image
image/gif 44.218.68.176
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjk1MDgxMzQxOSIsImVidXkiOiIzNzA0NzAwOTU5IiwiZWFkdiI6IjQ0MzA1MzIxMSIsImVjaWQiOiIxMzg1MTcyNzE4MDkiLCJlZW52IjoiaiIsImVwaWQiOiIvMTAwOTY0MS9TcG9rZXNtYW5EZXNrdG9wX1JPU19DYXRmaXNoXzcyOHg5MCIsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=de-DE&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=fda23cc6-0e43-4bb3-9a54-cbc40a442947&pid=0a759b58-c34f-449e-a472-6bd5bc8d8466&dtm=1746950112431&qnm=_matherq&visible=1&tabid=1a828ece-814e-4a33-a49f-ade62eb7342c&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&vp=1600x1200&ds=4000x5408&tofa=1746950108&vid=1&lvidt=1746950108&duid=c08a15a3-caf2-445a-a025-dfb3ba7cf400&fp=1556103320&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.68.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-68-176.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 43
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Sun, 11 May 2025 07:55:12 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 14EE 0
0 42ms
42ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsucrWj0Qjvf6R0t7fO0z6dyfElXKXFNkRfF94SdEEdjHj6VKGK-oMD2_CaNZ8gPtEPa1K4c2R9YH2wCNe5I3MCVszScEqQmJ569M0eR1Sb9CutNecyqgD0Di44sbSIMXMQrOMW4lUGcI21VyRU3_sabfIZg7fznl6jYTTj0HuNgEemyc0QPSIxThGBg4lTXVOweuZTkKGAbjobjp40RU4759OTS52XcDC6kO0xRkBm9sP7YE7SWeStsZA-mBIM89wmiS4uPqVZh4F5JHQuEhasAa9RzZnXAvIImgX05qsQnGNyeVzWnxiAroUWZs4VsVvZLNOvCumfgsMU9HwRquGDkWmo7NnOw9ilBp6Zuf8Zjrhn_FTXxjlq3-DdEl5mVX5fUbbMO478ZFGAe59C9CjC67ya2wmyrqsQ98T7dLinHY9Lpw7HLVcfVkTMvOr4TGGZBRCMhiHTkaT49sDHHhplEqA&sig=Cg0ArKJSzOqXJMasRq8rEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 11 May 2025 07:55:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 204
No Content /
adspsp.com/pt/4364783/23/1/ 0
110 B 333ms
333ms Image
image/png 52.32.178.217
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://adspsp.com/pt/4364783/23/1/?a=2,a2majczm50Qphu2N4a8R,7ZunmTSpYT&aa=a1,000GumhX.u1:1---&a2=T1.m.0.2.a.a&a3=0,3m0,0,1,1,1,1,1,6,6,6,6,1,0,0,0,0,6,6,6,6&b=I1,1q,1,2,:g3,4:,:s5:1n,:h1:2,8,6,,6,:r0,:D,,,5,g8,7,zu,cU::,:S1C,:Rb,6a,g:,:Rl,bU,1S:,:Rd,Dz,x:,:Ru,QS,2Z:,:Rz,R3,2P:,:Rp,WZ,2T:,:Ro,1rf,2W:,:RJ,1NL,3e:,:RZ,2aj,3t:,:RX,2aD,3u:,:RY,2aK,3v:,:R19,2cF,3x:,:D,,,5,g8,7,zu,cU:,:H,,,0::,:C5c,:b,:Rb,6a,g:0,,Z,,0:,:b,:Rl,bU,1S:0,,1r,,0:,:b,:Rd,Dz,x:0,,15,,0:,:b,:Ru,QS,2Z:0,,Z,,0:,:b,:Rz,R3,2P:0,,1u,,0:,:b,:Rp,WZ,2T:0,,15,,0:,:b,:Ro,1rf,2W:0,,1r,,0:,:b,:RJ,1NL,3e:0,,15,,0:,:b,:RZ,2aj,3t:0,,G,,0:,:b,:RX,2aD,3u:0,,U,,0:,:b,:RY,2aK,3v:0,,15,,0:,:b,:R19,2cF,3x:0,,,,0:,:D,,,5,g8,7,zu,cU:,:H,,,0::,:q5l,1,2,:D,,,5,g8,8,zu,72::,:Q7z,1,2,5,n,o,p,q,p,q,:D,,,5,eG,5,y2,72::,:c7A,:D,,1C,1,,5,hU,72::&b=G5l,2,:K9,:ka,b,c,d,e:f,:kg:h,:ki:j,:kk::,:L1:&b=Kl,:km:&bi=Uy1066RGIfSa5,adb-dt-anchor-slot,1009641,SpokesmanDesktop_ROS_Catfish_728x90,728x90,0.05,0x0,728x0,tags,ebola%20outbreak,sex%20abuse,world%20health%20organization,congo,united%20nations,section,News,category,nation-world,adb_pvd,t5a,pos,sticky_footer,tZ0nx,42IxXh,2rcgm5j,7AoU5R&bt=uKScDz6&c=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&d=&f=1.majczlwd.2T8f.3T3dt&g=3T3ug&u=Cx33bcf6f:mafk1c8u:16&v=18g.xc.0.48p.1.0&adbj=gbv3majczm34erm&mp=0.3&adb_cm=t5a&adb_flag=lrc&txx=Txx4&rnd=1746950112534
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.178.217 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-178-217.us-west-2.compute.amazonaws.com
Software: linux /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Length: 0
Content-Type: image/png
Server: linux
Connection: keep-alive

POST
H2 200 ingest.php Show response
events.newsroom.bi/ 2 B
294 B 28ms
26ms Fetch
application/json 104.18.24.90
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=6814
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer

Response headers

access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 93e01cdbed5ed25d-FRA
access-control-allow-origin: https://www.spokesman.com
content-length: 2
date: Sun, 11 May 2025 07:55:12 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 index.js Show response
cdn.pranmcpkx.com/ 7 KB
0 0ms
0ms Script
text/javascript 13.107.246.45
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://cdn.pranmcpkx.com/index.js
Requested by: Host: cdn.e3fbosf1tz3d.xyz
URL: https://cdn.e3fbosf1tz3d.xyz/prod/spokesman/t8y9347t.min.js?2025411
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

x-azure-ref: 20250511T075509Z-15f677d574b2qp9thC1FRA5qps00000005yg00000000551f
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 75
x-ms-request-id: 88108b53-301e-0048-36b7-c0ea89000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 11 May 2025 07:55:09 GMT
x-ms-blob-type: BlockBlob
content-type: text/javascript
vary: Accept-Encoding
last-modified: Fri, 17 Jun 2022 17:08:13 GMT

HEAD
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 0
24 B 28ms
28ms XHR
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16845642317752434031
x-content-type-options: nosniff
expires: Sun, 11 May 2025 07:55:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 11 May 2025 07:55:12 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52276
x-xss-protection: 0
server: cafe

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ 0
239 B 52ms
11ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=24298
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f2725c115d816cae2dce6044d9cf3fcf
Pragma: no-cache
Content-Type: image/gif

GET
H/1.1 200
OK cksync.php
cs.media.net/ 59 B
425 B 85ms
53ms Image
image/gif 2.23.244.30
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.244.30 Doha, Qatar, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-244-30.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: bd95e8a7f7c6225934f3f14a6cdc3876566284966667fc32f88fe141e3713da6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Cache-Control: max-age=0, no-cache, no-store
Timing-Allow-Origin: *
Pragma: no-cache
Connection: keep-alive
Expires: Sun, 11 May 2025 07:55:13 GMT
x-mnet-hl2: E
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Content-Length: 59
Date: Sun, 11 May 2025 07:55:13 GMT
Content-Type: image/gif
Server: Apache

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ 43 B
364 B 109ms
62ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE...

General

Check archive.org

Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&gdpr=1&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE Criteo Technology SAS, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1128587
expires: Sun, 11 May 2025 00:00:00 GMT
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Sun, 11 May 2025 07:55:12 GMT
content-type: image/gif
server: Kestrel

GET
H2 204 v1
match.sharethrough.com/universal/ 0
58 B 3215ms
54ms Image
text/plain 18.184.119.72
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.184.119.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-184-119-72.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 122ms
72ms Image
image/gif 35.214.136.108
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=medianet&gdpr=1&gdpr_consent=&gdpr_pd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.214.136.108 Groningen, Netherlands, ASN19527 (GOOGLE-2, US),
Reverse DNS: 108.136.214.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sun, 11 May 2025 07:55:13 GMT
content-type: image/gif

GET
H2 204 redirectuser
ssp.disqus.com/ 0
41 B 403ms
190ms Image
text/plain 34.224.66.164
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.224.66.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-66-164.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

pragma: no-cache
expires: 0
cache-control: no-store

GET
H2 204 pixel
ap.lijit.com/ 0
193 B 163ms
39ms Image
text/plain 52.213.109.81
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.213.109.81 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-109-81.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-origin: *
date: Sun, 11 May 2025 07:55:13 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT

GET

getuid
ib.adnxs.com/
Redirect Chain

https://ads.servenobid.com/getsync?redirect=chrome%3A%2F%2Fversion%2F
https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%2...

0
0

GET
H2 200 cm
us-u.openx.net/w/1.0/ 43 B
267 B 102ms
58ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcs.media.net%2Fcksync.html%3Fcs%3D8%26type%3Dopx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 149.88.19.250
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sun, 11 May 2025 07:55:12 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 39ms
38ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505060101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

POST
H2 200 / Show response
ph.givebutter.com/e/ Frame E2AE 13 B
103 B 102ms
100ms Fetch
application/json 3.95.129.122
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://ph.givebutter.com/e/?ip=1&_=1746950113398&ver=1.212.1&compression=gzip-js

Requested by

Host: givebuttercdn.com
URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.95.129.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-95-129-122.compute-1.amazonaws.com

Software

envoy /

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://givebutter.com/

Response headers

cross-origin-opener-policy: same-origin
content-encoding: gzip
x-envoy-upstream-service-time: 8
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://givebutter.com
date: Sun, 11 May 2025 07:55:13 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: envoy
access-control-allow-headers: X-Requested-With,Content-Type

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 14EE 42 B
65 B 41ms
41ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuql23T5ofNzdVuYfSCOEsDREzRH68bffaSJpUCASsDlhu-b4pWzKXs-USEICM0qRUuAEiy6e864t8nagyt_pQH93V2zvkUM5JCN9J7fZi-LqP6roJ1pNO3q6_UdhgsP5qW-UJeTF1GWN8FzesUx0pqTutwyQYGZgy6FHp_X8O7dxsye60p1Q&sig=Cg0ArKJSzNK2gJHv9dE1EAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&tm=1030.3999996185303&tu=30.799999237060547&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250507&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=2659927189&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4288291200&rst=1746950112405&rpt=31&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 11 May 2025 07:55:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame 43A9 200 B
841 B 11ms
5ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://givebutter.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2256858
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 07:55:14 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Fri, 11 Nov 2022 20:25:37 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 309804
x-content-type-options: nosniff
x-request-id: cc4b5771-42fa-4b5c-bffb-8444526c03ed
x-served-by: cache-fra-etou8220054-FRA

GET
H2 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 43A9 526 B
451 B 20ms
12ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Response headers

x-request-id: da3a700d-3a2f-478f-b25b-d201e96572f6
content-encoding: br
etag: "d96c709017743c0759cf3853d1806ba5"
age: 2231010
x-content-type-options: nosniff
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT
date: Sun, 11 May 2025 07:55:14 GMT
last-modified: Fri, 11 Nov 2022 20:25:36 GMT
content-type: text/javascript; charset=utf-8
x-served-by: cache-fra-etou8220054-FRA
x-cache-hits: 292330
vary: Accept-Encoding
strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=31536000
timing-allow-origin: *
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 315
server: Fastly

GET
H2 200 inner.html Show response
m.stripe.network/ Frame A8C6 930 B
2 KB 68ms
13ms Document
text/html 18.173.205.14
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.205.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-205-14.fra56.r.cloudfront.net

Software

Cloudfront /

Resource Hash

34a85e78b5402c253c2bc4cf64426c2b6b18601602e8a9a71568139fb3ee6599

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 225
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Sun, 11 May 2025 07:51:30 GMT
etag: "f5eaddb4dfc7e121aba2112e1ca3ef2d"
last-modified: Fri, 09 May 2025 17:26:51 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-amz-cf-id: E8B4LAQ5HdGgX4Syp5_MLOAhm-gMzeDvQn2A4WMCeQaVGVEjdVePaw==
x-amz-cf-pop: FRA56-P12
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/ Frame E2AE 119 KB
35 KB 20ms
19ms Script
text/javascript 142.250.185.74
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

sffe /

Resource Hash

cbe7b92b6b2165acf1b82a479f81db1e0d77182a24c818d31838edd1500be6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
age: 164992
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Sat, 09 May 2026 10:05:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 09 May 2025 10:05:22 GMT
last-modified: Wed, 07 May 2025 17:43:41 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 35971
x-xss-protection: 0
server: sffe

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/ Frame E2AE 319 KB
73 KB 21ms
21ms Script
text/javascript 142.250.185.74
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

sffe /

Resource Hash

d6fb64efcc2eec18b7e0b1eb0346005ce5f090dfdd3ba3e188ea90fdeb311cda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://givebutter.com/

Response headers

content-encoding: br
age: 82634
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Sun, 10 May 2026 08:58:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 10 May 2025 08:58:00 GMT
last-modified: Wed, 07 May 2025 17:43:41 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 74520
x-xss-protection: 0
server: sffe

GET
H2 200 out-4.5.44.js Show response
m.stripe.network/ Frame A8C6 87 KB
14 KB 50ms
49ms Script
text/javascript 18.173.205.14
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://m.stripe.network/out-4.5.44.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.205.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-205-14.fra56.r.cloudfront.net

Software

Cloudfront /

Resource Hash

bd6e71e0a8f18b3dd4bbeb6fd673015fec896bd92e17c11f3dc8fe96a06de1f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://m.stripe.network/inner.html

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=300, public
content-encoding: br
etag: W/"fd35981a337052cd3ccd82dc674ff76d"
age: 174
x-content-type-options: nosniff
via: 1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: kzVJoDi4YMCfNnXEL8XXbXLTpEo9EVoL1OYLxJXLet4qmfxq4fB5xg==
date: Sun, 11 May 2025 07:52:21 GMT
content-type: text/javascript; charset=utf-8
last-modified: Fri, 09 May 2025 17:26:51 GMT
server: Cloudfront
x-amz-cf-pop: FRA56-P12
vary: Accept-Encoding, Origin

POST
H2 200 6 Show response
m.stripe.com/ Frame A8C6 156 B
837 B 696ms
339ms XHR
application/json 44.241.247.1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.44.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.241.247.1 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-241-247-1.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

5f9edad6725cf84190f97d976d0824bb2aa8df3b60e66558b5db272b00caab17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://m.stripe.network/

Response headers

x-stripe-proxy-response: upstream
x-envoy-attempt-count: 1
x-content-type-options: nosniff
x-stripe-bg-intended-route-color: green
x-stripe-server-rpc-duration-micros: 2948
x-stripe-outbound-proxy-type: envoy
x-stripe-inbound-proxy-type: mesh-proxy
date: Sun, 11 May 2025 07:55:15 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Content-Type
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-credentials: true
x-stripe-upstream-host: 10.76.173.127:1643
access-control-allow-origin: https://m.stripe.network
content-length: 156
x-stripe-server-envoy-start-time-us: 1746950115138335
x-stripe-client-envoy-start-time-us: 1746950115137929
server: nginx

POST
H3 204 collect
region1.analytics.google.com/g/ 0
0 20ms
20ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=45je5571v869949972za200zb71896582&_p=1746950107706&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~103101750~103101752~103116025~103130498~103130500~103200001~103233427~103251618~103251620~103284320~103284322~103301114~103301116&ptag_exp=101509157~103101750~103101752~103116026~103200004~103233427~103251618~103251620~103284320~103284322~103301114~103301116&cid=366061901.1746950108&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEIAAAQ&dt=Panel%20finds%2080%20alleged%20abuse%20cases%20tied%20to%20WHO%27s%20Congo%20work&sid=1746950107&sct=1&seg=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fsep%2F28%2Fpanel-finds-80-alleged-abuse-cases-tied-to-whos-co%2F&_s=4&tfd=7970
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.spokesman.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 11 May 2025 07:55:15 GMT
content-type: text/plain
server: Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.circularhub.com
URL: https://api.circularhub.com/2871/48979fe04f6431c3/flyertown_module.js

Domain: d31qbv1cthcecs.cloudfront.net
URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js

Domain: aamcftag.aamsitecertifier.com
URL: https://aamcftag.aamsitecertifier.com/aam.js

Domain: api.pymx5.com
URL: https://api.pymx5.com/v1/sites/load_optional_tags

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=235&t=2&li=gpt_m202505060101&jk=3745048750418345&bg=!eHulezTNAAbgx1aQwMc7ADQBe5WfOM2aF-m5MNAJ0uJ3G_9MfhDdVsasJvRsAua0_O6IijZ94Da8KAvyEEc2qz2hQupvAgAAADJSAAAAAmgBB34ANizBE2ea8UlJ_yNEQYLf4X6Kx75K58jW41-Bep1OcUs8oC8gjtWz3Jx-LTGsAFXc8NZv7hn2WwoA6l0SC8O9YLFGxObMU-sVXUDUtF0CkZP9zjLK3rEiZJku7fNj7zXxd0syzMGSHjP1FgyifCKebNTzS7drWceZNbfHpDmyefqZ-3j88qM54VA1DnIqle-5u5iItKcNrNXdSrF4MTbp8ksHIhYHhn8v7Ye8pf5QfvA_NVipVgwns-66ygnEEEKW2-yorF0ZI0vAr_7HQk72fxGQh1evJ6bEJExM78jGmD4NNwighnStM8L0KIR1mGybPzRxIKS0yFc83Oe4wJSGt4MYFgO4ch_ZNYDs3ZjIsxPVfmh9jVdOo031irm6Vd1nERxbapkCZ1jugMelGLoXOiLsRh5vp9_da99zYtGvIcLmxX2jChe4G4STRolHNu4jm6SiFNnSpwgp-Zi0KSFcuPJMd-sow4U6VH6SHhJDDvU61Xsvwriy-TCbEagg3a238thbG6EnwMQsuiSW1jzfHBozfQH27Q48OgNxqJGG-z3wbIirVSadPjV8fBfht8i3ofoGxsSZNqTHnxHuPi6iN9xn93ZNYvK27OqAj31VnSK7FZMLWws7-CoXuStEg0aB7lkKoY4jBTiEywz_BK80jiEWVC1nEPZ8GAfRzE686v1bOAL01cNM8jatnBcvCBIKY4xbMUO5TWC8gJhpL2nU3bvjoCEovTrgR4GNcfZuNdDmKDeOinbDNBb3EWNtUHTIAJm5zCSiIRoRdRWYtI6jWHZAmZTg1Sn9v-4pkaZuBkOqPfX6E1YRayqjTVvpnisomFh0OKIZerAF-Epm5qfTKDMow3cNn1Whsj4EUQJwmlIrUZcqma_H2-zv_PKTJowKLHQWcGnWEXapVeZg0pz0_dulLkroTy14SCmhSc7sqDmoDkHCjxql4-jceQAYxGN9sk0JsRcCaKoY7cMXo-EG2VjQisLoYI7enmf1eb7Uw1yfEHAqB6Q-zikl_FCMmwF50xADyyD1Ekg2GthWI96iLTbMoTD3srP2eW5pDRXfcOUgaU0EvJM2jvVfjbDZAIU2Q8ZiNtdUWrocB9ovviKIbCry6OmBdxwPYGrl6q-aSo3sOZRGQ5G3ri0QDNcFh3PO9SRyNPQBKU5WL7zcbymkq7s8sc8oaxTLs_cTYN7GvGm_pJMwE0oizoM8OfdGQw

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID%26redirect%3Dhttps%253A%252F%252Fads.servenobid.com%252Fgetsync%253Fjp%253D1%2526redirect%253Dchrome%25253A%25252F%25252Fversion%25252F

Verdicts & Comments Add Verdict or Comment

146 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.criteo.com/openrtb_2_5/pbjs/auction	1970-01-21 14:37:26	Name: cto_bundle Value: T7q0wF9aRU81RjklMkJkMGFjZTRHYTd5azZ1Tk9pVzRoc05ZbXhJUllRSFgxNFBwMEV3dFRacFhBdUJyRkNTT2V6RDdXS0VFVkZCNVdsTjV4eVdqJTJCZnZrSW5MOFVpSjBCenp0cktsUldlcjBWYkZYTGclM0Q
www.spokesman.com/	1970-01-21 14:01:26	Name: flipp-uid Value: 1f407198-fb3e-45c2-8ea5-dbcd42174928
.givebutter.com/	1970-01-21 05:15:51	Name: __cf_bm Value: cuE8uOBC1Gvjn61unJGR0kQFBcf1PwSqac8kGd4BpZ8-1746950107-1.0.1.1-tmX6YrMmJeWcp5bu6TTTALZeYj_i5T7zjFAdQsFKh89l9NPXeH2oNoE4Gog6eaPQplk8YdCoX3HohOLFi2o4kOmPrhEHAgYrd5JUz_xSCXo
.spokesman.com/	1970-01-21 14:51:50	Name: _ga Value: GA1.2.366061901.1746950108
.spokesman.com/	1970-01-21 05:17:16	Name: _gid Value: GA1.2.2142407574.1746950108
.spokesman.com/	1970-01-21 05:15:50	Name: _dc_gtm_UA-230256-14 Value: 1
.spokesman.com/	1970-01-21 05:15:51	Name: _sp_ses.53c5 Value: *
.spokesman.com/	1970-01-21 05:15:50	Name: _gat_gtag_UA_230256_14 Value: 1
.spokesman.com/	1970-01-21 09:35:05	Name: ___nrbic Value: %7B%22isNewUser%22%3Atrue%2C%22previousVisit%22%3A1746950108%2C%22lastBeat%22%3A1746950108%2C%22currentVisitStarted%22%3A1746950108%2C%22sessionId%22%3A%227f462312-a1fe-4c48-8bb4-d42b29aa44c7%22%2C%22sessionVars%22%3A%5B%5D%2C%22visitedInThisSession%22%3Atrue%2C%22pagesViewed%22%3A1%2C%22landingPage%22%3A%22https%3A//www.spokesman.com/stories/2021/sep/28/panel-finds-80-alleged-abuse-cases-tied-to-whos-co/%22%2C%22referrer%22%3A%22%22%2C%22lpti%22%3A%222021-09-28T10%3A08%3A00%22%7D
.spokesman.com/	1970-01-21 09:35:05	Name: ___nrbi Value: %7B%22firstVisit%22%3A1746950108%2C%22userId%22%3A%22ebfaed68-6861-49a8-be69-f102fe69ea53%22%2C%22userVars%22%3A%5B%5D%2C%22futurePreviousVisit%22%3A1746950108%2C%22timesVisited%22%3A1%7D
.spokesman.com/	1970-01-21 09:35:05	Name: compass_uid Value: ebfaed68-6861-49a8-be69-f102fe69ea53
events.newsroom.bi/	1970-01-21 09:35:02	Name: 6814_u Value: ebfaed68-6861-49a8-be69-f102fe69ea53
events.newsroom.bi/	1970-01-21 05:59:02	Name: 6814_lv Value: null
events.newsroom.bi/	1970-01-21 05:59:02	Name: 6814_ut Value: 0
.p.flipp.com/	1970-01-21 14:51:50	Name: gid Value: "ykB+QwAAvKSQauseAP3GaA=="
prebid.media.net/	1970-01-21 09:35:02	Name: receive-cookie-deprecation Value: 1
www.spokesman.com/	1970-01-21 14:01:26	Name: ai_user Value: 8zzDX\|2025-05-11T07:55:08.726Z
.spokesman.com/	1970-01-21 14:01:26	Name: anonDeviceId Value: 2561fb0016fc32abc1b39f655d4d1d0b
.spokesman.com/	1970-01-21 14:01:26	Name: nxt_last_visit Value: 1746950109161
.givebuttercdn.com/	1970-01-21 05:15:51	Name: __cf_bm Value: aiHv9uSE_agGg7ijwIVZas1TpPhzM.ZUY8.m2x3kxPY-1746950109-1.0.1.1-bRNU_htE7.4KLWUe6EebgpUU1FdyUdeqbIxksPK0pYpSd95IOimX03zZGCHa2XQSY2.SxeXhIA9wSYtgd7co9iHtwtc270kzfKHjG1TLHy4
www.spokesman.com/	1970-01-21 05:15:51	Name: ai_session Value: NLJEL\|1746950109636.1\|1746950109636.1
.spokesman.com/	1970-01-21 09:35:02	Name: __eoi Value: ID=de8460169090cdf7:T=1746950110:RT=1746950110:S=AA-AfjZuyN5TMz0JqJCiZLxxCCZZ
.givebutter.com/	1970-01-21 14:01:26	Name: cf_clearance Value: z.XCYdXlUMo9n8_koH5vtyLIVR5kv_JaRB26Lpdd58w-1746950110-1.2.1.1-QCLcNZFmslMJ2Fo8BlKlEOdi2TyZQj6R.rNaMyXJ2yOcdoCmMIU6i4RqtwdAeQDLDIr_058u3EzIXfR2w6akeyC0k5sDtSIanxs.nTYT.nw2dpGa85VpjpiriaJb_iAAjPeLfzsL8km09umQt_ACpkl12iOfMaCDOlxk12b_XTaejamPGgail5jFyGDxTEedSxAp7JA5Oz8Vgan_S7ugxrkAeP_m1jp2AEZUOcK34N7J6qOtQYELpK0KWoEhJuDh.QvEZic2YW57sZFKq1amgGseegTXsO7gCpCVA_I9k4ISDSz3pJbiwo8j8PRp9r_.KZOXC.o7xXlrx_gCODjGaaJURXwiyDEVfSub1moDn74
events.newsroom.bi/	1969-12-31 23:59:59	Name: 6814_s Value: 7f462312-a1fe-4c48-8bb4-d42b29aa44c7
.spokesman.com/	1970-01-21 14:01:26	Name: nxt_upd_ac_SR_SPOKESMAN_PROD Value: 1
.spokesman.com/	1970-01-21 14:01:26	Name: nxt_SR_SPOKESMAN_PROD Value: {%222%22:{%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22FTV_RW%22%2C%22FTV_RW%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1746950111024%2C%22far%22:0%2C%22frp%22:[]}}}
.spokesman.com/	1970-01-21 07:25:26	Name: _fbp Value: fb.1.1746950112099.408908636602657574
.spokesman.com/	1970-01-21 14:51:50	Name: _ga_G3BY0LGVDL Value: GS2.1.s1746950107$o1$g1$t1746950112$j55$l0$h0
.spokesman.com/	1970-01-21 14:51:50	Name: _sp_id.53c5 Value: c08a15a3-caf2-445a-a025-dfb3ba7cf400.1746950108.1.1746950112.1746950108
m.stripe.com/	1970-01-21 14:51:50	Name: m Value: 4f8abfd2-7f1b-418b-9da4-cb99e6bca2ebbc0867

96 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js(Line 10) Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network	error	URL: https://idsync.rlcdn.com/712559.gif?partner_uid=1f407198-fb3e-45c2-8ea5-dbcd42174928 Message: Failed to load resource: the server responded with a status of 451 ()
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=UA-75318216-1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 10) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-f+Q9zpc2qiV/joz+A2q2bPWw4NQ0QxaN8m7NXLR1KSw='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 22) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-v3cUkOSb6iG8auIrRnUd3NgHbw6FImipXG1p49nX8kI='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback&render=explicit' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://kit.fontawesome.com/c37fafd8d9.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 28) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-Fy2d3Xn0M01YH9ENE61oxoo/OsSi1Vp0ZBXiC2+l7FA='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://challenges.cloudflare.com/turnstile/v0/b/701fd2559006/api.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.givebutter.com/elements/latest.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 35) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-sxBmqRxoytionxj4tRsfv6rJTZBFEc3fFAVQtKV24g8='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 64) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-KSIQ0NnyftZ+gbJDQYCuXrHAHKgxwHhXqSHA4j7nLG0='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://connect.facebook.net/en_US/sdk.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 76) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-isOMrEEAbq34RH7hYcAGqOL1GtaI8Xg8AEnTie7GFlI='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.stripe.com/v3/' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://www.googletagmanager.com/gtag/js?id=UA-75318216-1(Line 84) Message: [Report Only] Refused to load the script 'https://www.google-analytics.com/analytics.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://cdn.plaid.com/link/v2/stable/link-initialize.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://connect.facebook.net/en_US/sdk.js(Line 21) Message: [Report Only] Refused to load the script 'https://connect.facebook.net/en_US/sdk.js?hash=e11dd02663805d1c8cbbe37c165f4e57' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype(Line 1788) Message: [Report Only] Refused to connect to 'https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.braintreegateway.com/web/3.102.0/js/client.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.braintreegateway.com/web/3.102.0/js/paypal-checkout.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.braintreegateway.com/web/3.102.0/js/venmo.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://js.braintreegateway.com/web/3.102.0/js/data-collector.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/embed.lFim9v84.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/Flow.BPkqgaF8.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/EventTicketsFlow.Cq-UwxQ1.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/_commonjsHelpers.D6-XlEtG.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/ContactInfo.B2CUzmcH.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/LabeledPhoneInput.DEqwDrCx.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/filepond-plugin-file-validate-type.esm.B_ANaPmy.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/index.DYVuyAVS.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/numeral.B_3j-8rd.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/PaymentAccordion.BfPQcHbS.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/LinkShare.BaRoQU2N.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/emoji.DUOHsx9g.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/client.DZflzfXp.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/Svelecte.RSFjb1Xx.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/index.D4uN2bNE.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 100) Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 101) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-zFLPq5jC8JM+/wMvrfxnijtJRzIrsuEyRNze3ZIB9iQ='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL Message: [Report Only] Refused to load the script 'https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/js/pro-v4-shims.min.js?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/js/pro-v4-shims.min.js?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/js/pro.min.js?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/js/pro.min.js?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-EoJD49dvl6QOLWplCkY2M1HxH5oQvn42A0cfgrCkWPo='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://kit.fontawesome.com/c37fafd8d9.js(Line 1) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-3lMNl+4IbBw3Ze4jJJ4Cjiw+R9gzGOhIoZgS72iWbck='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js Message: [Report Only] Refused to load the script 'https://ph.givebutter.com/array/phc_cwIyuSjjEpyhbDj5a0cRqmSpB5O8CyMDb7ZBiS8MRy7/config.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/decide/?v=3&ip=1&_=1746950110399&ver=1.212.1&compression=base64' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/decide/?v=3&ip=1&_=1746950110399&ver=1.212.1&compression=base64' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/globe@2x.Btpk9ooJ.1.0.0.js Message: [Report Only] Refused to load the script 'https://givebuttercdn.com/apps/prod/build/utils-21.2.7.mLZ22td5.1.0.0.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js Message: [Report Only] Refused to connect to 'https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Heart%20Anim.json' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js Message: [Report Only] Refused to connect to 'https://givebutter.com/storage/assets/flow/animation/Donate%20-%20Seal.json' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/shield-check.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/duotone/shield-check.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/light/spinner-third.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/light/spinner-third.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/arrow-left.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/arrow-left.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/facebook.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/facebook.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/x-twitter.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/x-twitter.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/linkedin.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/linkedin.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/whatsapp.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/brands/whatsapp.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/envelope.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/solid/envelope.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/copy.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	Message: [Report Only] Refused to connect to 'https://ka-p.fontawesome.com/releases/v6.6.0/svgs/regular/copy.svg?token=c37fafd8d9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://js.givebutter.com/elements/latest.js Message: [Report Only] Refused to connect to 'https://givebutter.com/elements/api/v1/zN1p7WO2gDzLLkGa/elements/usage?url=https%3A%2F%2Fgivebutter.com%2Fembed%2Fc%2Fsupport-local-journalism%3FgoalBar%3Dfalse%26gba_gb.element.id%3Dp57vbL' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebutter.com/embed/c/support-local-journalism?goalBar=false&gba_gb.element.id=p57vbL(Line 101) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-9KqwD9fkpu8Lp9uPRA+yYV5Je5Zk36TCl322lhCAjPo='), or a nonce ('nonce-...') is required to enable inline execution.
security	info	Message: [Report Only] Refused to load the script 'https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/e/?ip=1&_=1746950110459&ver=1.212.1&compression=gzip-js' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/e/?ip=1&_=1746950110459&ver=1.212.1&compression=gzip-js' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/datetime.BpX6K-10.1.0.0.js(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	info	URL: about:blank Message: [Report Only] Refused to load the script 'https://givebutter.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebutter.com/cdn-cgi/challenge-platform/scripts/jsd/main.js Message: [Report Only] Refused to connect to 'https://givebutter.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.33216633245225974:1746947422:jLHvUwd6yuX4XBRzPQX-vHP5ZD5Q_zuxK7ssbpSyj_E/93e01cc2bc952bb2' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 Message: [Report Only] Refused to connect to 'https://givebutter.com/cdn-cgi/rum?' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js Message: [Report Only] Refused to load the script 'https://ph.givebutter.com/static/recorder.js?v=1.212.1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js Message: [Report Only] Refused to load the script 'https://ph.givebutter.com/static/dead-clicks-autocapture.js?v=1.212.1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js Message: [Report Only] Refused to load the script 'https://ph.givebutter.com/static/dead-clicks-autocapture.js?v=1.212.1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
network	error	URL: https://api.circularhub.com/2871/48979fe04f6431c3/flyertown_module.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://api.pymx5.com/v1/sites/load_optional_tags Message: Failed to load resource: net::ERR_CONNECTION_RESET
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/sodar2/235/runner.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0E01C00F4170000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://aamcftag.aamsitecertifier.com/aam.js Message: Failed to load resource: net::ERR_SSL_UNRECOGNIZED_NAME_ALERT
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/e/?ip=1&_=1746950113398&ver=1.212.1&compression=gzip-js' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://givebuttercdn.com/apps/prod/build/usePosthog.CpoFC8fX.1.0.0.js(Line 2) Message: [Report Only] Refused to connect to 'https://ph.givebutter.com/e/?ip=1&_=1746950113398&ver=1.212.1&compression=gzip-js' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	info	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype(Line 1642) Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/common.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	info	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyA-HrsGwQ0MW-YRyd-jp_YqJ0RmuY5LLqs&libraries=places&callback=Function.prototype(Line 1642) Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps-api-v3/api/js/60/12/intl/de_ALL/util.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6d59a7f82a054feef04ec3bfd7d3939d.safeframe.googlesyndication.com
aamcftag.aamsitecertifier.com
ads.servenobid.com
adspsp.com
ap.lijit.com
api-mg2.db-ip.com
api.circularhub.com
api.pymx5.com
az416426.vo.msecnd.net
btlr.sharethrough.com
cdn-gateflipp.flippback.com
cdn.a3kvau184uea.com
cdn.e3fbosf1tz3d.xyz
cdn.plaid.com
cdn.pranmcpkx.com
cdn.q0losid.com
cdn.sy57d8wi.com
cdn.wgchrrammzv.com
challenges.cloudflare.com
connect.facebook.net
cs.media.net
d31qbv1cthcecs.cloudfront.net
dc.services.visualstudio.com
dis.criteo.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
events.newsroom.bi
exchange.kueezrtb.com
fundingchoicesmessages.google.com
givebutter.com
givebuttercdn.com
grid-bidder.criteo.com
hb-api.omnitagjs.com
hb.minutemedia-prebid.com
hb.yellowblue.io
ib.adnxs.com
idsync.rlcdn.com
js.braintreegateway.com
js.givebutter.com
js.matheranalytics.com
js.stripe.com
ka-p.fontawesome.com
kit.fontawesome.com
m.stripe.com
m.stripe.network
maps.googleapis.com
match.sharethrough.com
p.flipp.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
ph.givebutter.com
pixel.rubiconproject.com
prebid.a-mo.net
prebid.media.net
prg.smartadserver.com
prod-spokesman-proxy-connext.azurewebsites.net
prod.adspsp.com
prodmg2.blob.core.windows.net
pymx5.com
region1.analytics.google.com
s3.amazonaws.com
sdk.mrf.io
securepubads.g.doubleclick.net
ssp.disqus.com
static.cloudflareinsights.com
static.spokesman.com
stats.g.doubleclick.net
thumb.spokesman.com
tpc.googlesyndication.com
us-u.openx.net
web.hb.ad.cpe.dotomi.com
widgets.givebutter.com
www.facebook.com
www.google-analytics.com
www.google.de
www.googletagmanager.com
www.i.matheranalytics.com
www.spokesman.com
x.bidswitch.net
aamcftag.aamsitecertifier.com
api.circularhub.com
api.pymx5.com
d31qbv1cthcecs.cloudfront.net
ep1.adtrafficquality.google
ib.adnxs.com
104.16.80.73
104.18.24.90
104.18.40.68
104.18.94.41
104.19.220.32
104.20.37.218
104.26.2.180
104.26.5.15
107.178.250.234
108.177.15.156
13.107.246.45
13.107.246.60
13.33.187.112
13.35.58.11
13.35.58.60
13.85.16.224
142.250.184.193
142.250.184.225
142.250.184.226
142.250.185.104
142.250.185.142
142.250.185.161
142.250.185.195
142.250.185.74
142.250.186.98
142.250.74.206
143.244.197.139
143.244.200.230
151.101.130.133
151.101.64.176
157.240.0.6
157.240.251.35
163.5.194.36
172.217.16.130
178.250.1.38
178.250.1.9
18.173.205.14
18.184.119.72
18.245.86.11
2.23.244.30
20.50.88.233
20.60.62.4
216.239.34.36
3.161.82.35
3.5.16.95
3.72.6.211
3.95.129.122
34.1.1.166
34.120.63.153
34.224.66.164
34.234.209.110
34.247.115.141
34.98.64.218
35.214.136.108
35.227.203.93
35.244.174.68
37.252.173.215
44.218.68.176
44.241.247.1
52.213.109.81
52.217.163.217
52.222.136.19
52.222.236.85
52.32.178.217
64.158.223.146
69.173.144.138
89.149.193.80
00c99b5a5a184a82850f69d54e2b4fc68135b6fd3da3c9797033c50570a72c18
029c66e08436d3da3c1f43ebe156865402b33501627a172de145ca463481534a
02a30ea6b407de1b91903c7b846cd49cf8bd7fde84369dac046578a845b2481a
0399699a7279e9e5c8b1fef1962029bdd83c8883e9ef314e5585cded68304f5d
03ead4f04bab625255f63b23982637a01d410e17859484da407565bf957c35e4
049f3bd130a52e47649eaf5ea920d08413199dd3fb528672b702d6bffac1ab7c
04c7010a54c2c69a1b976febd24056bb6097d5c8dc31d1f64e1a42249926c38d
05f8e18ff6cfd0f6301a221842c6b541261607caa65edbb1d93c69d3f5001e2d
06505bb1af78b8d1ae281cb611b4ab2c733bd9ece50bc32c535c950b9f913811
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
0b780f81f93de50fb58febc38f6c3fcc88db1bf39d13bb316fbffb4388f70d72
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cb1bf32539483f685b02b014d2a44009828e0345cfad31af0f082df7bac97a6
0d4f69207ae904a2f73c54879516db74b495a4255a77b3b53072cf335123004a
103336c754fde9c2c7fc565bc5385b94409c0d5480cd8564c25f18f6cced5a85
128243e3d76f97a40e2d6a650a46363351f11f9a10be7e3603471f82b0a458fa
1395f9dfbc141826fbc67b90204496b4cc97d9ac6171ff4c88ace15abc649850
15eca989381d4b9c996b23992775d3c24307d08baacc5ce34dc3ea33f68cb7f7
15ff29496ac40d398a774a309adfc1777340b666b3d00474a368da343bf266d7
162771d52a1d4860c270cede556d0088620b7454fd4bd59e0eae9dc740403e09
1768c23832bcb03d3fcdd3f6edf07a71f0c5c7b6323e50a4fa2e9276cd30800e
19abc0bf04517d277a8159f6df85d62bdaae81c51e9c9b4f4392202ddee40b05
1cc2b777ed8a6ec44643a3497e17ad131e75bb592e6fdd5ef9e82fa9658a0d45
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1dfae417465bc4ba3e518e6adee43d27c0aeee39eaf536d68ca301b0cafb1145
1e32a373b9c4d358c5a47f1f5b2b6c5cedf0d8bdfae37e273be811615cc83862
1f08b9a120a041d6c73e69bc274d6261b474d3ec71151a8c2b940858e1026d8f
1fd8651da4452b29620b594e1f0e28509bdbf93079e85a95d54297740603d7ad
2304236f31bac2a5cfa8519c2ea5de2db40be11589620f76aac0ffaa777c6762
23dd2a9d31ac5ee27bc8d601812cb813b3f986f704c73cd74242691221021ecd
24469dde41b86409cc63a244b88b37dc5acd6f9823c59a63084a9a5311d43d90
297bd0260f572990cfa4545594c1510192ae33b78ec211ebb84aa74d79ceb1a1
2d9f8cd6984fed9b5196dc9b4d2da9ac37226be6c94a39ee2f56073f73e22093
2f219207f3d6a30452c637cb2c1e1d2ffaf4852a0d55acf36ade1a47cf729640
2f4e461046f3bb7885829e48f8dab784f2b1e65c8a115742488762af28829d41
34a85e78b5402c253c2bc4cf64426c2b6b18601602e8a9a71568139fb3ee6599
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
366642ee1b00ba222c70283fb41feaece3718858063e2e99164366ff8adce61b
3a023c645ddb158b4c10efe2492281ec830314c76c52d95acdc89e3a70227755
3b0a863df8ff7675e7f475e64dcd92f6cb648e7c6953c2cb51aaea986a25d9ab
3dda5d66b2884ca37dda8bbfe1e77a3d088f181d068aa17cdf0d2f21ca9765cf
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
459ad44dd647d3544551e4ab7848cbfdd29799adac87a8a7e9767acb66e8fa79
478eb7d52d6939db24f8e7bec9738452f26be903f33d085272fe96aded025c9c
48a815ebcf46dd19a6240a60e2f17fc5c99461989428b87471f8cc82534dd871
492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2
4a925c97add89114b1a2147ac8d0df86cec22526a957795fc0b87c365d292ee8
4b8e7e33f617e9e985d6e5ef4998381721e8cb0279f789b206cb0e58eac75913
4cc88e309177d92c0dbc370458cf4739082e37e2b988c50a8002a1433c052593
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e554bc156b6e3a3d05525af219824241f504293f0300b40d8ca1385bbaf2b6b
4fda72116dacabbed70d130340385957ac9da610a6fb1938f4433ee40e47bdc5
5061e2bedaa3c5093f8ec2a4b35da8acd4880978fd0606468e222b4068b2917e
51a6ce669ce12679bc8f89ea5949c2007917727698ddaef180c47f4d7dbfa7cd
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
52891b99945a4e935874efd838a240525e0b7d934ee308556f6ecc92d7553ace
540be8c635852201795247d645c29293a6b7cb6d6fb05e22a8676b52d91fee19
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
563f81beb3f77223df0b04738213c7b911d686c367c85850ef4ca5245aabd087
569014b221a3fec6083500d09ecd17f8739b6466d374cb152be16c6bc1ff05cd
56b197972b901062f7ddd1da69d3cba8213671539f5b04272818cfb385de5301
59269992b50afa23926326e86714ae0e9507488992fe1975361422662ee6a2ff
5a252b9a96e5aa3f0dc99c702219819ddf46cfdfba95f2e00f4e5d32387a634d
5f9edad6725cf84190f97d976d0824bb2aa8df3b60e66558b5db272b00caab17
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
63a23d48c43ca0a5b222f254b40a76115629a44af82e790c6ec2e92795240b20
65e3cc7fa948d838346bf198e5142d6a06ee6a9574d3f1dd1a2b0d017a282099
67d0bdfdfd7aeda525143a544eae4164b01310d19d62149cd5d37304f0b42e51
685952ca8db3fc8fd55925ff916a4553638942a4ae799e2d2c82ed0e3854560d
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
6a65146e588cb9b4da0ed50d019fa26b01f86f969f642b3207fdf121a3f9a9ac
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b93bcb4dfb73d4005a866b024c24e35827c0728fbefff901bfddbbfefd8fda0
6da225ff41d13daccdc866596691039b7d0dbab13fc5f91ac7fe8e2279603000
6effd8b04358306dbc5dd017fa15e822ebe2ab13ca09489b6abccafe40287789
704bedf7a9c2795b107f5b24b99b5275648c72a409ec3fa7b680de1a0f123144
707e3e8cf365a9b00090d96e3964b191e83ca2c484d1fee66e84be4b92bb0bb6
73c98920f05b2af9793c598970d1082b7c3a739ffea83dc981ecd550a25f93f2
79df73fd1377483384f7b7565e98c4a430889f0388db05634271f9f302faeac7
7a471672f3f91ad82285192cae07b7e06f4b2baddec73d8e6898a1a445f5d0ea
7ac3677e23d988059a7f8ce54c455ff98cd2dbf163bf8bc1b6eaac75c838228d
7d0bb9556119625f4c7b1882f705e38fcfb5779a9d82985f8e96cb056d5a848d
7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56
7e1a265736848ddd027d8f640c0078da748d36604187ff08b55b9b8edab3f8f3
7f23af6adc7ea6c31b559530d3d85ae93198314ce5844b7d452a158a07432560
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851d3d9028e7f9b70c04b2e1a1c32b99e68f59395c95cc0e691cb1bb2fa7d4ce
856ca1ff9bf0886b1ca22ba2f59f0fe805be7dde4ed8e849a3aa2cb07d3f8cca
864b19efbddca842373a716d23fafeb056990174c8560865bf026dd1bc1201bf
87b010edc18752647dcd8749bfe9abea7cb1eaf4f3ea4de0898b3ed325b1ed08
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a4d006fa66a00b55ff8e3d07754dd803cc52efb31f9714870ba604c93a4c0c4
8f5caeedfcf4bf5de497608add8409bb627cf4c1923c82e76de906cdd3ed5c0d
920d6ad6f88618b9536120a740d74c1523313fee1717ef5a75385da286808e8d
94463d6613d2657c837b25ea591747d6ee86700dcaed5800f34591cf2230afb5
95f80d6fda95841abad766cfdeb5a8f8253617c94dd833f025add9796c712489
992c3b7f9e36464e9e12189dc404c5c781bcfbc7d65d0a1d9398b30d4b33913d
9acaa1c96a86c79f5c628de318c6a95d4645946bb59e5b0f6663369ceee8c605
9bf67ff94214ba7bcfa5a423bcb3d46a173efae1a8d2f723b40af00385c87d99
9ef22c9cf20460bbc639afd09b42f03a4e91db23bf8d774280653a7845b157de
a02f78e600e8272c473819f97a46a1c070f8ceeddaf29ac5655e371375e9456a
a120a51667f8a7d4c6202c1ca0df9a2a458633a96f2c1c57116434887a5d3565
a2702f6a67d243b8c2451ed8022b8fd0a6701cd104781ad922dc25fc6aa6fc3b
a2cd69554b92111a977a7dad5894fab189378b6a52b754021100b9ab11a34489
a2fdfed84c31fff7b05803b3c1dc59a65956e4f0b1dbf13ce4b2340caa621c2e
a3b0141ea859572c13c726fdcbfe59613dca592d844df273f45b22b8f5007a80
a431b44f5dee485517960556b3400da39d89716fec8fa3d8691a66d3d42f8560
a761989d03c3bc3c4f54e5b249fa4616c9ef6a3bac072d02789f69d44b2db102
a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c
a818e9f64e6062493c2f08078990ef5529ae59638c8202c690520ae905b35f0b
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8
ad494e9aacbcc5547f12c8293d92fa47e9e3597fe246bacc1f57efd2b400b437
adaf07c7701d826d9875cbb76bcb113ee13a1058ae744e4d18a10f2e4fed258c
afc1b28f4f82c7ced1664c9fdf044c4a2570ed9e96da9ed548103b7a01000b08
aff2114e664d09888407bc8a2c3793e5554ea928fec4caffea0487b9a3332a7d
b0ee583ec077fde22c36c75a03d7c8e2bc82a78d6c11519e6178770132822260
b15aceb04dbf5604df5617cfe984f48479cb131c1df02825d1c24e9f35d01857
b346830ae8412dee5e7b821cf164d9cbc443ffdd606baaa37b2ef397aae14975
b3aa2c059437af622be6abf87d58e045c85321f5fa7a89d1a3e4c033aa4b5515
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
bd6e71e0a8f18b3dd4bbeb6fd673015fec896bd92e17c11f3dc8fe96a06de1f4
bd95e8a7f7c6225934f3f14a6cdc3876566284966667fc32f88fe141e3713da6
bdb9c31c82af189d8c6c851298ea91b1be792ae1745172232a9fe6b41499025d
bde73fd53f3fe3f006b2ccad0e21b7c38c1e994301329f33f4c685323c49dd71
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
bff1c96ca3f6b21f3ced9e31535b931d3ea0ae42efb49fb529c9aa8c98ea9bf7
c118d1fca2998e4679455c91d4a0eb4a516d3d49bff9540bca8e3c6d21118a2d
c183d139162d5bb93065e4de0dbba9f4d713764fb9589e61d62dbb5f1a682a61
c24a1ab5a36b5ab1827da8c3fa51348be759febeaf3c67fbf46946cd08e0a4aa
c3f4864802c06951ceafa99a8fb279608ad8916696cadd3c0ec4ae6ddb1d8136
c4c1d392a90c31f031c21d7aa51f04d0bb359027db47c5234da034da75689961
c67d6a406ff72f17cfbbfaed1574f1ffce1d15c26c4496ebac83e606becda886
c681ddfcff5aec120ad5b731ab77494bfd2fae4c03f8bbaafc5e6fece11fb028
c7067ad0a4b1fce8953045a7b24c04d26fb1dfcb095f925f8ea2c961e0a5634c
c78493afeeaa3ff629bf1327b46b6432e8e3bb1c8e05f7c890cb486fca7d5538
c87b1ac68fcdd87aba62be35fd55eb8888d87b6e648d88dfd35330335938b02b
c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a
ca0ba71b383a70dfd62c73bd1676f387fc57f5dff42c2b805f5ab594114bce52
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa976b62fb6b8808a12c08ee3434d1b41d614d404674fd4a3fd7c0528c923f4
cbe7b92b6b2165acf1b82a479f81db1e0d77182a24c818d31838edd1500be6e3
cc98b1044edf4051dbca3cf94f5974274b464e16b8e32e4af9c2e89b0b2d9673
d077807b2373375b2d5c8ffbfeeea0bcb152e29c21ec147aecfab6b5502e5463
d16f6737bf4c2018a4ec87665a3e6d5699cd9d6469e3ae793108aca6a7fe448b
d1961511f562aa5192c80e9b7922f3a9abd5c397372eff924c52842cd52d787d
d570f130ada6f735a85879c5a7b01c106bdd124b80892ed66af241dbf85b86e7
d6fb64efcc2eec18b7e0b1eb0346005ce5f090dfdd3ba3e188ea90fdeb311cda
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d8282af7cb6a3d9dacc0d3fa3d57e958b0fcc210d3acd82b2591ea7198421124
d890e2e4c70263205b52c10bac30491c0d7a13ebe5b3ee1123825eade66d097b
d99c12972bba3b40b8358fac2265585dd5d677da8db81b8f9475d6120fad3c0c
d9ebb8350799ffcdbd1143898dddc93a350fe53e2d790773a2510f9618966753
da0c53e8878f4d05a347a2edb7edcdb25e6c80dcea31f037b65c1103d0591a6e
da83fbbef0baaca05320982fb4bee293959ec222e4683ded73a621ed24dae559
dbc4c944a2abdd71f26c31458b90ae46a60fcb5f7673cf86e155755015282c03
dc1293460e62d8f4d91ef29b9bac4f123837f7c2c840ef3a52763782c12bc682
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de530d97ee086c1c3765ee23249e028e2c3e47d83318e848a19812ef68966dc9
df5ea2615f1e65c25f3100090d372768cecf9c0485138bb61c5ccee0a1f42f2c
e0c3c1e9d6b575fee5fe7cfd2fc0c8731747221e25d451a23138b92d2b7d0d88
e10bf746591a863ffe6a312abf6199f366735bb3fc50b4432c54abd2caa39a2a
e190004f753344f8dca8e365f2f3b1ad003c2198ead3ced744018bada78952de
e36eef9fe41a6a81c62d8cadddeb7ef0c904dfc0fa1b6deff3314ef610f45a0c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5b90cb9b70eb820dae848b31c7541836b44c6356ed5b3985379c445340c1b1a
eafde1b9321c5218874c0c1058664721eaa0c69a6846fed417c392cd3c0d5418
eceea9ec229684ba339474ad50f60f0c8b08706c4e2bff6a7018d0f8eab579af
eea91a5722b6b36943fa218f20242fdb98bf41a350e75204765b2f843164ad25
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f1ce556665f40cf05d19b34b433fbcf4617673a73ee960beaee64405a3f6dbf7
f2c50a16459c96e45c44e339dba2764807e8c3a174cdd8804f3fbee6a6b19198
f389ec7b05bbbed807a5a7114b3c011141d7c20ff9e6b5eb6591b40e6024f150
f58921ec9151a34826886c1f0cc2c18e289c5a77bae74084ca05084f298db597
f5a01f79f64d5b9ef018f69222a4b31357301ca04ed99ef802ad95e753c9a17e
f6a55e008070dfa78b131827c914ccaadf3de9ddaf61b0938b1dc46fa3ae337c
f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785
fb128d11873821d66616bc81a3229f7b664483472e52213dc15e39e5716d6dcc
fe6d410b84a3f94a20c4be9625ea8a41ec7f825e6e707ee6ee57d992f065cc5e
ff29561d28196b2e6106ed73de445b309a6b3d29c61b275ac06bea071b2d9095

www.spokesman.com Open in urlscan Pro 18.245.86.11 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

281 Requests

97 %HTTPS

0 %IPv6

60 Domains

79 Subdomains

68 IPs

7 Countries

6450 kBTransfer

20343 kBSize

30 Cookies

34 Outgoing links

Redirected requests

281 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.spokesman.com Open in urlscan Pro
18.245.86.11 Public Scan

Screenshot
Live screenshot

Full Image

281
Requests

97 %
HTTPS

0 %
IPv6

60
Domains

79
Subdomains

68
IPs

7
Countries

6450 kB
Transfer

20343 kB
Size

30
Cookies

281 HTTP transactions
8 data transactions