heraldcourier.com Open in urlscan Pro
192.104.183.209 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email.alerts.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NEQUphaEFwV2hBZ0dNSi03MGZWNEVvZlJXdHJralN5OD0iLCJocmVmIjoiaHR0cHM6...
Effective URL:
https://heraldcourier.com/
Submission: On December 04 via manual (December 4th 2023, 7:38:23 pm UTC) from US — Scanned from DE

Summary HTTP 234 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 83 IPs in 8 countries across 64 domains to perform 234 HTTP transactions. The main IP is 192.104.183.209, located in United States and belongs to LEE-ASN, US. The main domain is heraldcourier.com.
TLS certificate: Issued by GTS CA 1P5 on October 31st 2023. Valid for: 3 months.

This is the only time heraldcourier.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:25e... 2600:9000:25e8:6e00:d:e169:8180:93a1	16509 (AMAZON-02) (AMAZON-02)
9	192.104.183.209 192.104.183.209	10668 (LEE-ASN) (LEE-ASN)
43	104.16.133.24 104.16.133.24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	18.239.69.131 18.239.69.131	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
7	18.65.39.72 18.65.39.72	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	18.238.243.82 18.238.243.82	16509 (AMAZON-02) (AMAZON-02)
1	23.57.19.78 23.57.19.78	16625 (AKAMAI-AS) (AKAMAI-AS)
2	65.9.66.122 65.9.66.122	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::ac43:246e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::6816:3456	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::6816:445	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
3	54.216.8.15 54.216.8.15	16509 (AMAZON-02) (AMAZON-02)
1 2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	18.238.17.128 18.238.17.128	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	35.204.89.238 35.204.89.238	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.227.217.72 13.227.217.72	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:225e:a200:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	107.178.250.234 107.178.250.234	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	13.227.222.191 13.227.222.191	16509 (AMAZON-02) (AMAZON-02)
3	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	52.84.179.168 52.84.179.168	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5914	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:244... 2600:9000:2447:9200:a:e047:753:a221	16509 (AMAZON-02) (AMAZON-02)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:209... 2600:9000:2090:200:10:dd8:5e40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	52.17.99.225 52.17.99.225	16509 (AMAZON-02) (AMAZON-02)
2	141.95.33.120 141.95.33.120	16276 (OVH) (OVH)
1	54.198.156.105 54.198.156.105	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	34.120.107.143 34.120.107.143	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6816:545	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	44.212.199.129 44.212.199.129	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1f18:730... 2600:1f18:730:b150:8a29:493b:1f46:72ba	14618 (AMAZON-AES) (AMAZON-AES)
1	34.206.108.117 34.206.108.117	14618 (AMAZON-AES) (AMAZON-AES)
1	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
1	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 11	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	23.2.235.168 23.2.235.168	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.155.246.37 35.155.246.37	16509 (AMAZON-02) (AMAZON-02)
1 5	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	52.18.121.48 52.18.121.48	16509 (AMAZON-02) (AMAZON-02)
1	162.19.138.116 162.19.138.116	16276 (OVH) (OVH)
2	23.43.61.119 23.43.61.119	16625 (AKAMAI-AS) (AKAMAI-AS)
6	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	50.17.66.232 50.17.66.232	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:2c:... 2a02:26f0:2c::216:f221	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:1f18:ed:... 2600:1f18:ed:550e:bb8f:8f68:a616:96a6	14618 (AMAZON-AES) (AMAZON-AES)
19 25	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:25e... 2600:9000:25e8:1200:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 5	46.228.174.117 46.228.174.117	56396 (AMOBEE) (AMOBEE)
3 4	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:e43e:a85c:2848:83d	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	3.65.68.8 3.65.68.8	16509 (AMAZON-02) (AMAZON-02)
1 1	52.57.111.197 52.57.111.197	16509 (AMAZON-02) (AMAZON-02)
1	18.245.60.10 18.245.60.10	16509 (AMAZON-02) (AMAZON-02)
2 3	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
3 3	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1 2	18.198.126.47 18.198.126.47	16509 (AMAZON-02) (AMAZON-02)
1	52.44.250.119 52.44.250.119	14618 (AMAZON-AES) (AMAZON-AES)
1	72.246.169.24 72.246.169.24	16625 (AKAMAI-AS) (AKAMAI-AS)
1	216.52.2.39 216.52.2.39	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
3 4	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
2	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
1	52.213.214.202 52.213.214.202	16509 (AMAZON-02) (AMAZON-02)
1	2.19.84.188 2.19.84.188	16625 (AKAMAI-AS) (AKAMAI-AS)
3 3	35.156.210.91 35.156.210.91	16509 (AMAZON-02) (AMAZON-02)
1	198.47.127.19 198.47.127.19	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
2	216.52.2.48 216.52.2.48	() ()
2	3.68.0.8 3.68.0.8	() ()
1	37.157.5.133 37.157.5.133	() ()
234	83

1 2600:9000:25e8:6e00:d:e169:8180:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

email.alerts.heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 192.104.183.209 (United States)

ASN10668 (LEE-ASN, US)
PTR: cms.newyork1.vip.townnews.com

heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

43 104.16.133.24 (None, )

ASN13335 (CLOUDFLARENET, US)

bloximages.newyork1.vip.townnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bloximages.chicago2.vip.townnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.239.69.131 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-69-131.ams58.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.65.39.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-65-39-72.ams1.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.243.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-243-82.ams58.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.57.19.78 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-19-78.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.66.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-122.fra56.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:246e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.hadronid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:3456 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:445 (United States)

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.216.8.15 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-8-15.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.131.137 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.17.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-17-128.ams58.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.204.89.238 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 238.89.204.35.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.217.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-217-72.ams54.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:a200:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.227.222.191 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-222-191.ams54.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.179.168 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-179-168.cdg50.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5914 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2447:9200:a:e047:753:a221 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2090:200:10:dd8:5e40:93a1 (United States)

ASN16509 (AMAZON-02, US)

connectid.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.99.225 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-99-225.eu-west-1.compute.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 141.95.33.120 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203256.ip-141-95-33.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.198.156.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-198-156-105.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:3::c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.107.143 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 143.107.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:545 (United States)

ASN13335 (CLOUDFLARENET, US)

a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 44.212.199.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-212-199-129.compute-1.amazonaws.com

bidder.newspassid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:8a29:493b:1f46:72ba (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.108.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-108-117.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.75.62.37 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.2.235.168 (Schiphol, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-2-235-168.deploy.static.akamaitechnologies.com

s.ntv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.155.246.37 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-155-246-37.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.18.121.48 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-121-48.eu-west-1.compute.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.116 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533567.ip-162-19-138.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.43.61.119 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-43-61-119.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-jsonp.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.17.66.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-66-232.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2c::216:f221 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sli.heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:ed:550e:bb8f:8f68:a616:96a6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 35.204.74.118 (Groningen, Netherlands) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:25e8:1200:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 46.228.174.117 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
usermatch.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.248.245.213 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:e43e:a85c:2848:83d (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.65.68.8 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-68-8.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.111.197 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-111-197.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.60.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-60-10.fra60.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbid.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.226 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.198.126.47 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-126-47.eu-central-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.44.250.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-250-119.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.246.169.24 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a72-246-169-24.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.39 (United States)

ASN30282 (AS-INAPCDN-OCY, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.82 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.214.202 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-214-202.eu-west-1.compute.amazonaws.com

ad2.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.84.188 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-84-188.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.156.210.91 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-210-91.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.19 (United States)

ASN3257 (GTT-BACKBONE GTT, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.48 (None, )

ASN- ()

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.68.0.8 (None, )

ASN- ()

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.5.133 (None, )

ASN- ()

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	townnews.com bloximages.newyork1.vip.townnews.com — Cisco Umbrella Rank: 17221 bloximages.chicago2.vip.townnews.com — Cisco Umbrella Rank: 21370	670 KB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4333 i.simpli.fi — Cisco Umbrella Rank: 3745 um.simpli.fi — Cisco Umbrella Rank: 780	12 KB
25	doubleclick.net 4 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	231 KB
18	googlesyndication.com 2 redirects f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 148 pagead2.googlesyndication.com — Cisco Umbrella Rank: 102	358 KB
13	newspassid.com bidder.newspassid.com — Cisco Umbrella Rank: 23523	41 KB
11	heraldcourier.com 1 redirects email.alerts.heraldcourier.com heraldcourier.com sli.heraldcourier.com	100 KB
9	google.com 1 redirects region1.analytics.google.com — Cisco Umbrella Rank: 2693 ampcid.google.com — Cisco Umbrella Rank: 2783 www.google.com — Cisco Umbrella Rank: 2	2 KB
7	adlightning.com tagan.adlightning.com — Cisco Umbrella Rank: 2257	212 KB
6	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2977 rp.liadm.com — Cisco Umbrella Rank: 1632 rp4.liadm.com — Cisco Umbrella Rank: 6685 i.liadm.com — Cisco Umbrella Rank: 517 i6.liadm.com — Cisco Umbrella Rank: 2358	19 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	523 KB
6	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 306 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 614 aax.amazon-adsystem.com — Cisco Umbrella Rank: 410	73 KB
5	openx.net 2 redirects oajs.openx.net — Cisco Umbrella Rank: 1639 google-bidout-d.openx.net — Cisco Umbrella Rank: 1643 us-u.openx.net — Cisco Umbrella Rank: 491 rtb.openx.net — Cisco Umbrella Rank: 695	1 KB
5	google.de www.google.de — Cisco Umbrella Rank: 6765 ampcid.google.de — Cisco Umbrella Rank: 85078	1 KB
5	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 979 bcp.crwdcntrl.net — Cisco Umbrella Rank: 850	25 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	3 KB
4	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 372	1 KB
4	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 936	3 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	255 KB
4	criteo.com 2 redirects gum.criteo.com — Cisco Umbrella Rank: 424 mug.criteo.com — Cisco Umbrella Rank: 2811 dis.criteo.com — Cisco Umbrella Rank: 550	8 KB
4	segment.com cdn.segment.com — Cisco Umbrella Rank: 1681	35 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	22 KB
4	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 893 id5-sync.com — Cisco Umbrella Rank: 425	67 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 336	1 KB
3	lijit.com ce.lijit.com — Cisco Umbrella Rank: 835 ap.lijit.com	865 B
3	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2174 pbid.pro-market.net — Cisco Umbrella Rank: 7195	1 KB
3	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1258 usermatch.targeting.unrulymedia.com	378 B
3	matheranalytics.com 1 redirects js.matheranalytics.com — Cisco Umbrella Rank: 11626 www.i.matheranalytics.com — Cisco Umbrella Rank: 11414	43 KB
3	ad.gt id.hadron.ad.gt — Cisco Umbrella Rank: 1673 a.ad.gt — Cisco Umbrella Rank: 1869	4 KB
2	sharethrough.com match.sharethrough.com	69 B
2	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 544 image6.pubmatic.com — Cisco Umbrella Rank: 793	6 KB
2	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 339	478 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 1661	2 KB
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 499 d.agkn.com — Cisco Umbrella Rank: 686	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 465	1 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 546	712 B
2	moatads.com z.moatads.com — Cisco Umbrella Rank: 653 s-jsonp.moatads.com — Cisco Umbrella Rank: 17700	55 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	216 B
2	yahoo.com connectid.analytics.yahoo.com — Cisco Umbrella Rank: 4156 ups.analytics.yahoo.com — Cisco Umbrella Rank: 307	9 KB
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 3052 p1.parsely.com — Cisco Umbrella Rank: 2300	21 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	91 KB
2	adsrvr.org 1 redirects insight.adsrvr.org — Cisco Umbrella Rank: 557	235 B
2	gstatic.com www.gstatic.com	13 KB
1	adform.net cm.adform.net	106 B
1	360yield.com ad2.360yield.com — Cisco Umbrella Rank: 11022	199 B
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 138	546 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 408	98 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 848	446 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1556	421 B
1	intentiq.com sync.intentiq.com — Cisco Umbrella Rank: 846
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6102	175 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 674	236 B
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 940	277 B
1	segment.io api.segment.io — Cisco Umbrella Rank: 1340	175 B
1	ntv.io s.ntv.io — Cisco Umbrella Rank: 3712	164 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	4 KB
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 4118	494 B
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2133	1 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 2789	3 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 631	13 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 1740	8 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 313	1 KB
1	cloudfront.net d1eoo1tco6rr5e.cloudfront.net	668 B
1	hadronid.net cdn.hadronid.net — Cisco Umbrella Rank: 1790	10 KB
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1042	17 KB
234	64

	Domain	Requested by
41	bloximages.newyork1.vip.townnews.com	heraldcourier.com bloximages.newyork1.vip.townnews.com
25	um.simpli.fi	19 redirects
17	securepubads.g.doubleclick.net	heraldcourier.com tagan.adlightning.com securepubads.g.doubleclick.net
13	bidder.newspassid.com	bloximages.newyork1.vip.townnews.com bidder.newspassid.com
11	tpc.googlesyndication.com	2 redirects heraldcourier.com tagan.adlightning.com
9	heraldcourier.com	heraldcourier.com
7	tagan.adlightning.com	heraldcourier.com tagan.adlightning.com
6	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com tagan.adlightning.com
6	www.googletagmanager.com	heraldcourier.com www.googletagmanager.com
5	www.google.com	1 redirects heraldcourier.com tagan.adlightning.com
4	ib.adnxs.com	3 redirects
4	eb2.3lift.com	3 redirects
4	jadserve.postrelease.com	tagan.adlightning.com heraldcourier.com
4	www.googletagservices.com	tagan.adlightning.com
4	www.google.de	heraldcourier.com
4	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
4	cdn.segment.com	heraldcourier.com cdn.segment.com tagan.adlightning.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	x.bidswitch.net	3 redirects
3	cm.g.doubleclick.net	3 redirects
3	region1.analytics.google.com	www.googletagmanager.com
3	bcp.crwdcntrl.net	tags.crwdcntrl.net
3	c.amazon-adsystem.com	heraldcourier.com c.amazon-adsystem.com
2	usermatch.targeting.unrulymedia.com	bidder.newspassid.com
2	match.sharethrough.com	bidder.newspassid.com
2	ap.lijit.com	bidder.newspassid.com
2	pixel.rubiconproject.com
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	pixel.tapad.com	1 redirects
2	sync.1rx.io	2 redirects
2	i.liadm.com	tagan.adlightning.com i.liadm.com
2	www.facebook.com	heraldcourier.com
2	oajs.openx.net	1 redirects heraldcourier.com
2	gum.criteo.com	1 redirects tagan.adlightning.com
2	id5-sync.com	cdn.id5-sync.com
2	aax.amazon-adsystem.com	c.amazon-adsystem.com
2	js.matheranalytics.com	1 redirects heraldcourier.com
2	connect.facebook.net	heraldcourier.com connect.facebook.net
2	insight.adsrvr.org	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	id.hadron.ad.gt	cdn.hadronid.net
2	cdn.id5-sync.com	heraldcourier.com tagan.adlightning.com
2	tags.crwdcntrl.net	heraldcourier.com tagan.adlightning.com
2	www.gstatic.com	heraldcourier.com
2	bloximages.chicago2.vip.townnews.com	heraldcourier.com
1	cm.adform.net
1	image6.pubmatic.com	ads.pubmatic.com
1	ads.pubmatic.com	bidder.newspassid.com
1	ad2.360yield.com
1	rtb.openx.net	1 redirects
1	us-u.openx.net
1	googleads.g.doubleclick.net	1 redirects
1	www.googleadservices.com	1 redirects
1	idsync.rlcdn.com
1	ce.lijit.com
1	stags.bluekai.com
1	sync.bfmio.com
1	pbid.pro-market.net
1	sync.intentiq.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	s.ad.smaato.net
1	i.simpli.fi	tagan.adlightning.com
1	i6.liadm.com	i.liadm.com
1	dis.criteo.com	1 redirects
1	s-jsonp.moatads.com	heraldcourier.com
1	sli.heraldcourier.com	heraldcourier.com
1	z.moatads.com	tagan.adlightning.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	google-bidout-d.openx.net	tagan.adlightning.com
1	api.segment.io	cdn.segment.com
1	s.ntv.io	tagan.adlightning.com
1	cdnjs.cloudflare.com	bloximages.newyork1.vip.townnews.com
1	mug.criteo.com	heraldcourier.com
1	ups.analytics.yahoo.com	connectid.analytics.yahoo.com
1	esp.rtbhouse.com	invstatic101.creativecdn.com
1	rp4.liadm.com	heraldcourier.com
1	rp.liadm.com	1 redirects
1	a.ad.gt	tagan.adlightning.com
1	ampcid.google.de	www.google-analytics.com
1	www.i.matheranalytics.com	heraldcourier.com
1	p1.parsely.com	heraldcourier.com
1	ampcid.google.com	www.google-analytics.com
1	f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	connectid.analytics.yahoo.com	tagan.adlightning.com
1	invstatic101.creativecdn.com	tagan.adlightning.com
1	cdn.prod.uidapi.com	tagan.adlightning.com
1	static.criteo.net	tagan.adlightning.com
1	oa.openxcdn.net	tagan.adlightning.com
1	cdn.jsdelivr.net	tagan.adlightning.com
1	b-code.liadm.com	www.googletagmanager.com
1	cdn.parsely.com	www.googletagmanager.com
1	tag.simpli.fi	www.googletagmanager.com
1	d1eoo1tco6rr5e.cloudfront.net	www.googletagmanager.com
1	cdn.hadronid.net	heraldcourier.com
1	secure.cdn.fastclick.net	heraldcourier.com
1	config.aps.amazon-adsystem.com	c.amazon-adsystem.com
1	email.alerts.heraldcourier.com	1 redirects
234	100

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
subscriberservicesdsi.lee.net
legacy.memoriams.com
www.stringr.com
www.google.com
swvatoday.com
us59.dayforcehcm.com
bloxcms.com
bloxdigital.com

Subject Issuer	Validity	Valid
heraldcourier.com GTS CA 1P5	`2023-10-31` - `2024-01-29`	3 months	crt.sh
bloximages.chicago2.vip.townnews.com GeoTrust TLS RSA CA G1	`2023-03-13` - `2024-04-12`	a year	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.adlightning.com Amazon RSA 2048 M01	`2023-07-08` - `2024-08-05`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2023-02-20` - `2024-03-20`	a year	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2023-10-03` - `2024-10-03`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M01	`2023-10-08` - `2024-11-05`	a year	crt.sh
hadronid.net GTS CA 1P5	`2023-12-03` - `2024-03-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-07` - `2024-05-06`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-13` - `2023-12-12`	3 months	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
*.parsely.com Amazon RSA 2048 M02	`2023-05-06` - `2024-06-03`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2023-12-02` - `2024-12-29`	a year	crt.sh
*.segment.com Amazon RSA 2048 M03	`2023-11-14` - `2024-12-13`	a year	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-11-24` - `2024-02-22`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
cdn.prod.uidapi.com R3	`2023-11-02` - `2024-01-31`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-10-24` - `2024-01-22`	3 months	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2023-08-15` - `2024-02-08`	6 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.id5-sync.com R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
www.i.matheranalytics.com Amazon RSA 2048 M03	`2023-11-15` - `2024-12-14`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
bidder.newspassid.com Amazon RSA 2048 M01	`2023-05-03` - `2024-05-31`	a year	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-11-08` - `2024-02-06`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-03` - `2024-01-24`	6 months	crt.sh
*.ntv.io DigiCert TLS RSA SHA256 2020 CA1	`2023-08-28` - `2024-08-28`	a year	crt.sh
*.segment.io Amazon RSA 2048 M01	`2023-02-10` - `2024-02-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
*.postrelease.com Amazon RSA 2048 M01	`2023-02-09` - `2024-02-16`	a year	crt.sh
*.eu-1-id5-sync.com R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-25` - `2024-10-24`	a year	crt.sh
sli.leetemplates.com R3	`2023-10-05` - `2024-01-03`	3 months	crt.sh
*.360yield.com Amazon RSA 2048 M01	`2023-05-29` - `2024-06-26`	a year	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-11-26` - `2024-11-26`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2023-05-06` - `2024-05-04`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
*.targeting.unrulymedia.com Sectigo RSA Domain Validation Secure Server CA	`2023-05-10` - `2024-05-10`	a year	crt.sh
*.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-25` - `2024-06-18`	a year	crt.sh

This page contains 17 frames:

Primary Page: https://heraldcourier.com/
Frame ID: DBD040C03B6A21B4D437D3BD1BA78DFC
Requests: 172 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Frame ID: FCB57766344789CAFCCEF3ABC98010F9
Requests: 2 HTTP requests in this frame

Frame: https://f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 673C7D96431B93F37CD07E7454826AB5
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=heraldcourier.com
Frame ID: F2907FC9840B3D5CAE5C3204E03895C8
Requests: 2 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: 6B574F7D03B90E7FF7D95B4E41D1E055
Requests: 4 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: 9E3C600B25DBAE190C7989B044218153
Requests: 8 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: E40B0B3568580325191104C6965C59CE
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: B5B7773EBE90937F7702DC03099143EC
Requests: 8 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&euns=0&s=&version=v2.11.1&
Frame ID: 10D3BC063C2181B66A316F849DA6977A
Requests: 3 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: 806ADE0CE9BD32E8BF5A4F0DF7F2A81D
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C3DC67FD8FEB5B84287FA4CD7F7E2A1D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 94812AC05FCB3612E2D7B85B8C450C9B
Requests: 2 HTTP requests in this frame

Frame: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
Frame ID: 27B115725C8E1CBDAC49A8FC7583573F
Requests: 9 HTTP requests in this frame

Frame: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Frame ID: BE29584FBBAC001C1C8C6FD3F2562A95
Requests: 9 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&predirect=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26uid%3D
Frame ID: D22BD0D042B46B51114618240C858436
Requests: 2 HTTP requests in this frame

Frame: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Frame ID: 42F7C4FC0256B19E93E3459A64EA21BE
Requests: 1 HTTP requests in this frame

Frame: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Frame ID: 1B97F42B58189676C6297D851B48BD8F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bristol Herald Courier | Breaking News | | Read Bristol, VA and Virginia breaking news. Get latest news, events and information on Virginia sports, weather, entertainment and lifestylesCollectionCollectionCollectionVideoVideoVideoVideoAudioAudioAudioAudioVideoVideoCollectionCollectionCollectionCollection

Page URL History Show full URLs

https://email.alerts.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NEQUphaEFwV2hBZ0dNSi03MGZWNEVvZlJXdHJralN5OD0i... HTTP 302
https://heraldcourier.com/ Page URL

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

owl\.carousel.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

234
Requests

86 %
HTTPS

38 %
IPv6

64
Domains

100
Subdomains

83
IPs

8
Countries

3116 kB
Transfer

8828 kB
Size

62
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuc1Jgav8bnFYvcFNz5EghXEopoEwFEhoTguZg4oAJDHOf22RPWdObln2horJBdKYBXoQ1aZxxU39ym-wnvNmWSLpyQjnCFkM5yi7E8DUnVj74yLL1w1ZhY1JtG6yqVXFiVhE-djX1v3Cbhr0QYeWV4XAiZY1P-VurGGH1HOUIy0PZ1gjI_4Hh-qLN5HONcGK5ICMXCDVoqtxV0FLIOJ7YurKRdZiOsnbAeLi2Zrpadf9fCW1DROTuxL4Ui4Kb5WbYCHYPjia8y_vTXHwN6855zET9AAMBZMNSbGIJUPNKQxB3NPut852mG5Ym11Su83jJB8NPuH0TTFcINYSwvT1sRMAU%2526sai%253DAMfl-YRHuTvRx0E55oRS3irsDBA-NXFrczcwh5NTmgRwKbhmZ9mOR7R5iy5zptjFPwtl9XN_I5A5Zkl6UYknlURye3BQKQeYHL7CPyQ0Go92P6NyY6CJXcGYRkX3_mTsZ7H0hI_XRNoG1OylfUCU7sXoahjSKrRO1M6hVwBCKw%2526sig%253DCg0ArKJSzIs6IxgUsU0sEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253Dhttp://www.theveincompany.com

Search URL Search Domain Scan URL

URL: https://subscriberservicesdsi.lee.net/subscriberservices/Content/paymentpagesingle.aspx?Domain=heraldcourier.com&SubscriberLevel=DOP&Return=https%3A%2F%2Fheraldcourier.com%2F#tracking-source=header&ir=true
Title: Subscribe $1 for 6 months

Search URL Search Domain Scan URL

URL: https://legacy.memoriams.com/network/BristolHeraldCourier/Obituaries?online=1&utm_campaign=consumerdirect&utm_source=lee&utm_medium=np_s&utm_content=heraldcourier
Title: Share a story

Search URL Search Domain Scan URL

URL: https://www.stringr.com/xlFFejdUIVF
Title: Share video

Search URL Search Domain Scan URL

URL: https://subscriberservicesdsi.lee.net/subscriberservices/Content/AccountStatus.aspx?Domain=heraldcourier.com
Title: My Subscription

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//202%20S%20HAMPTON%2BBRISTOL%2BTN%2B37620
Title: 202 S HAMPTON, BRISTOL, TN 37620

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//212%20AKARD%20PL%2BBRISTOL%2BTN%2B37620
Title: 212 AKARD PL, BRISTOL, TN 37620

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//245%20FORT%20CHISWELL%20RD%2BMAX%20MEADOWS%2BVA%2B24360
Title: 245 FORT CHISWELL RD, MAX MEADOWS, VA 24360

Search URL Search Domain Scan URL

URL: https://swvatoday.com/
Title: SWVA Today

Search URL Search Domain Scan URL

URL: https://us59.dayforcehcm.com/CandidatePortal/en-US/leeenterprises/SITE/CANDIDATEPORTAL
Title: Join Our Team

Search URL Search Domain Scan URL

URL: https://bloxcms.com/
Title: BLOX Content Management System

Search URL Search Domain Scan URL

URL: https://bloxdigital.com/
Title: bloxdigital.com

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email.alerts.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NEQUphaEFwV2hBZ0dNSi03MGZWNEVvZlJXdHJralN5OD0iLCJocmVmIjoiaHR0cHM6Ly9oZXJhbGRjb3VyaWVyLmNvbS8iLCJpbnRlcm5hbCI6ImNlZjMwNzAxZTUzNjk2YTEwMiIsImxpbmtfaWQiOjI4MH0/25f50f2760e7f8d5d78a258ff72cda606c58b1a76900f8e64e65ad76cb630834 HTTP 302
https://heraldcourier.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://insight.adsrvr.org/tags/nebsjkp/21usqg2/iframe HTTP 301
https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

Request Chain 79

https://js.matheranalytics.com/s/ma1527/725149306/lee/ml.js?cb=1641 HTTP 301
https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js

Request Chain 113

https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1

Request Chain 121

https://rp.liadm.com/j?dtstmp=1701718697481&aid=a-058n&se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&tna=v2.11.1&pu=https%3A%2F%2Fheraldcourier.com%2F&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&wpn=lc-bundle&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0zIj5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTQiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xNSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE2Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTciPkNvbGxlY3Rpb248L3RpdGxlPg HTTP 302
https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&aid=a-058n&tna=v2.11.1&dtstmp=1701718697481&n3pc=true&wpn=lc-bundle&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&i6=MmEwMTo0YTA6MTMzODo5Mjo6Nw%3D%3D&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0zIj5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTQiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xNSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE2Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTciPkNvbGxlY3Rpb248L3RpdGxlPg

Request Chain 127

https://gum.criteo.com/sid/json?origin=publishertagids&domain=heraldcourier.com&sn=ChromeSyncframe&so=0&topUrl=heraldcourier.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=MkQdvnwxb2QyeHFnUXJPTXNMZUVWYlh6T3Blc2pXTlVtWWhCNXBkYm9OeVd2VG9yNWV1MDJKK1dndUsxTlUwcXVHeDFwb055RFk2emZrSWxxR1JQQTlvOGZNdmMvZGhwK0hxOEVwMGJ6bDV0dGN3YVRpenJZOWhXTGFmanJhQXBXMkNscnZ6L3k2ZmgxaVlRbGczSVZUKzN2dW00aG9iQWV6eXYzVkVxQ254WlN6MUhUb01oZHdlcFlhcmFyc0thc2VqTVFGL213N0RkWHhSZFZrd3dnY0d3UVQ5K0JwcU83K1hDZjE5a0tObkNwbmdPamRNTmhVVUQwRGNKQzBwRFoySVhLUm5TZ1lNa0kzQk5mN2plbDNBYkk0VklvS0pEWjU2a1YzRE1teTlEakdmRT18&cppv=2

Request Chain 130

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrf2_VRABGAEyCFhQrjHgP-WC HTTP 301
https://tpc.googlesyndication.com/simgad/1369886636433257115

Request Chain 131

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrfPo3AEQARgBMgjIkoSCyqD0Kw HTTP 301
https://tpc.googlesyndication.com/simgad/4135096395794578540

Request Chain 179

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-B1iEHRBfhuRvYGeOL012vxX2wfcSru_SnWKRtQ

Request Chain 183

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 184

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/12431DACDBCF44CC90BB57EE850E30D8 HTTP 302
https://sync.1rx.io/usersync/simplifi/12431DACDBCF44CC90BB57EE850E30D8?zcc=1&cb=1701718699804 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003

Request Chain 185

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=12431DACDBCF44CC90BB57EE850E30D8&dongle=yf3

Request Chain 186

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 187

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 188

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=12431DACDBCF44CC90BB57EE850E30D8 HTTP 302
https://d.agkn.com/pixel/10751/?che=1701718699812&ip=80.255.7.109&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217523104720004811406 HTTP 302
https://um.simpli.fi/aa_px?sk=217523104720004811406 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 189

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 192

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=12431DACDBCF44CC90BB57EE850E30D8;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=12431DACDBCF44CC90BB57EE850E30D8;mimetype=img;sr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=MzM4NzU4NjY2OTI3Mjc3OTA2NA== HTTP 302
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEJHuv95ThkPOj-upDNuUwDI&google_cver=1

Request Chain 193

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0&xl8blockcheck=1

Request Chain 195

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 196

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 197

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 198

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 199

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 200

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701718699512&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=qypuZYHtJ_Kr9u8Px4iY-AI&sscte=1&crd=&pscrd=IhMIwe7mlMT2ggMV8pX9Bx1HBAYv HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlMT2ggMV8pX9Bx1HBAYv&is_vtc=1&ocp_id=qypuZYHtJ_Kr9u8Px4iY-AI&cid=CAQSKQDICaaN6ZOaHkkUBHDpZwQD1cxMppVgiIncAACvX_1XMWvGcTCwTcHd&random=3272241776 HTTP 302
https://www.google.de/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlMT2ggMV8pX9Bx1HBAYv&is_vtc=1&ocp_id=qypuZYHtJ_Kr9u8Px4iY-AI&cid=CAQSKQDICaaN6ZOaHkkUBHDpZwQD1cxMppVgiIncAACvX_1XMWvGcTCwTcHd&random=3272241776&ipr=y

Request Chain 202

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=12431DACDBCF44CC90BB57EE850E30D8 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D12431DACDBCF44CC90BB57EE850E30D8

Request Chain 203

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=12431DACDBCF44CC90BB57EE850E30D8&expires=365

Request Chain 204

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=12431DACDBCF44CC90BB57EE850E30D8

Request Chain 205

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEN1zwhZK-uVsNIyJjG6Y5fA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=12431DACDBCF44CC90BB57EE850E30D8 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 217

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D HTTP 302
https://bidder.newspassid.com/setuid?bidder=openx&uid=ed0b48c9-022a-4040-90b9-6d429be6e00a

Request Chain 219

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813

Request Chain 221

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432

Request Chain 223

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid HTTP 302
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3

Request Chain 225

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432

Request Chain 226

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813

Request Chain 233

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid HTTP 302
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3

234 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
heraldcourier.com/
Redirect Chain

https://email.alerts.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NEQUphaEFwV2hBZ0dNSi03MGZWNEVvZlJXdHJralN5OD0iLCJocmVmIjoiaHR0cHM6Ly9oZXJhbGRjb3VyaWVyLmNvbS8iLCJpbnRlcm5hbCI6ImNlZjMwNzAxZTUzNj...
https://heraldcourier.com/

548 KB
63 KB

578ms
227ms

Document
text/html

192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.104.183.209 , United States, ASN10668 (LEE-ASN, US),

Reverse DNS

cms.newyork1.vip.townnews.com

Software

Resource Hash

613ee3275e0499c65cc5acae15b799975d0733505af7e15a05ba3f70443a6ea1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 224
cache-control: public, max-age=60, s-maxage=30, must-revalidate, proxy-revalidate
content-encoding: gzip
content-length: 62350
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 04 Dec 2023 19:34:30 GMT
etag: W/4731fb915b644dfd4b462d17bb52a7cf
last-modified: Mon, 04 Dec 2023 19:34:29 GMT
link: <https://bloximages.newyork1.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js>; rel=preload; as=script </shared-content/art/tncms/user/user.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.3c64d611e594b45dd35b935162e79d85.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js>; rel=preload; as=script
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: X-IPCountry, X-Townnews-Now-API-Version, Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-loop: 1
x-robots-tag: noarchive
x-tncms: 1.71.9; app12; 1.04s; 6.8M
x-ua-compatible: IE=edge
x-vcache: HIT
x-xrds-location: https://heraldcourier.com/tncms/xrds/
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
date: Mon, 04 Dec 2023 19:38:15 GMT
location: https://heraldcourier.com/
via: 1.1 google, 1.1 8ac1a27a8fede22f241f081ad0edec42.cloudfront.net (CloudFront)
x-amz-cf-id: DetVRhFIZR0HSjwKGVvfs7ZHQkIjPAAenyWpxwHZmfi3T0e9VlmyKQ==
x-amz-cf-pop: AMS1-P3
x-cache: Miss from cloudfront

GET
H2 200 jquery.min.d6d18fcf88750a16d256e72626e676a6.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/ 98 KB
34 KB 234ms
110ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461223
cross-origin-resource-policy: cross-origin
last-modified: Wed, 07 Jul 2021 20:09:22 GMT
x-vcache: MISS
server: cloudflare
etag: W/"60e609f2-1882c"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b78a034fc-WAW
expires: Thu, 28 Nov 2024 07:29:07 GMT

GET
H2 200 user.js Show response
heraldcourier.com/shared-content/art/tncms/user/ 3 KB
2 KB 115ms
114ms Script
application/x-javascript 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/user/user.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: 32209e964449881b7f2a21086506deccc49063673c2cfff6288598f843fc81c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:36:27 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 108
etag: W/"65568d4d-c46"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 1437
service-worker-allowed: /

GET
H2 200 bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/ 39 KB
11 KB 233ms
109ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 368681
cross-origin-resource-policy: cross-origin
last-modified: Fri, 06 Sep 2019 14:16:03 GMT
x-vcache: MISS
server: cloudflare
etag: W/"5d726a23-9bd8"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b789c34fc-WAW
expires: Wed, 27 Nov 2024 11:25:36 GMT

GET
H2 200 common.08a61544f369cc43bf02e71b2d10d49f.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 32 KB
12 KB 230ms
107ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd1991e3d8ce67431989f8cca95743706d110f064ed2b3609041a3f20e50d2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2183554
cross-origin-resource-policy: cross-origin
last-modified: Thu, 16 Mar 2023 19:39:17 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64137065-8154"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b283234fc-WAW
expires: Thu, 21 Mar 2024 06:45:40 GMT

GET
H2 200 tnt.ee95c0b6f1daceb31bf5ef84353968c6.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 11 KB
4 KB 232ms
109ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1040150
cross-origin-resource-policy: cross-origin
last-modified: Thu, 09 Nov 2023 15:29:52 GMT
x-vcache: MISS
server: cloudflare
etag: W/"654cfaf0-2d77"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b789a34fc-WAW
expires: Sun, 10 Nov 2024 08:04:35 GMT

GET
H2 200 application.3c64d611e594b45dd35b935162e79d85.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 4 KB
2 KB 180ms
58ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.3c64d611e594b45dd35b935162e79d85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

076f281a9257ad662f34badb12393195fdca0dc2fde9acd1f1628b9674a96aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2810734
cross-origin-resource-policy: cross-origin
last-modified: Fri, 23 Jun 2023 18:40:28 GMT
x-vcache: MISS
server: cloudflare
etag: W/"6495e71c-10fa"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b283134fc-WAW
expires: Sat, 22 Jun 2024 19:01:35 GMT

GET
H2 200 tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 2 KB
1 KB 233ms
110ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461222
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Oct 2023 21:37:38 GMT
x-vcache: MISS
server: cloudflare
etag: W/"653c2da2-9b8"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b789d34fc-WAW
expires: Fri, 01 Nov 2024 08:08:59 GMT

GET
H2 200 bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/ 107 KB
18 KB 181ms
61ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1040150
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Oct 2023 21:37:37 GMT
x-vcache: MISS
server: cloudflare
etag: W/"653c2da1-1ac2e"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282934fc-WAW
expires: Thu, 31 Oct 2024 06:21:08 GMT

GET
H2 200 layout.9509b461cedc7767649ee83a5b35c177.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/ 154 KB
28 KB 184ms
64ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/layout.9509b461cedc7767649ee83a5b35c177.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd2c680964b28dc283f3518e21720cd2f886e7bdb8d2f5b47809ef836c337d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461222
cross-origin-resource-policy: cross-origin
last-modified: Mon, 27 Nov 2023 14:35:16 GMT
x-vcache: MISS
server: cloudflare
etag: W/"6564a924-26683"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282a34fc-WAW
expires: Wed, 27 Nov 2024 20:01:22 GMT

GET
H2 200 lee.ds.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/ 97 KB
17 KB 182ms
62ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701414005

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5c357a5e69089e5088279fc5aaa5663d088815b3408a005dd6bc93b50bf7745

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 269362
cross-origin-resource-policy: cross-origin
last-modified: Fri, 01 Dec 2023 07:00:05 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65698475-18487"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282e34fc-WAW
expires: Sat, 30 Nov 2024 07:05:29 GMT

GET
H2 200 flex-notification-controls.e115619c5ab5d4eb38fbd29cc0d2ea9b.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/styles/ 6 KB
2 KB 179ms
59ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/styles/flex-notification-controls.e115619c5ab5d4eb38fbd29cc0d2ea9b.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a77010a20c4a6611c4230df5afe003914255a35909daabaaa5a8f0427c73eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 269362
cross-origin-resource-policy: cross-origin
last-modified: Tue, 28 Nov 2023 17:50:08 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65662850-183e"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282d34fc-WAW
expires: Sat, 30 Nov 2024 08:37:43 GMT

GET
H2 200 owl.carousel.d631cca58a0d014854c4a6c1815f1da3.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/styles/ 5 KB
1 KB 179ms
60ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/styles/owl.carousel.d631cca58a0d014854c4a6c1815f1da3.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b93740066fadbde00a03ff560765bd25b8e9ca74f7774a4633f61ce44b332991

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 642528
cross-origin-resource-policy: cross-origin
last-modified: Fri, 13 Oct 2023 13:11:35 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65294207-12c4"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282b34fc-WAW
expires: Wed, 30 Oct 2024 06:28:53 GMT

GET
H2 200 access.d7adebba498598b0ec2c.js Show response
heraldcourier.com/shared-content/art/tncms/api/ 70 KB
29 KB 151ms
149ms Script
application/x-javascript 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/api/access.d7adebba498598b0ec2c.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: 8e683a0ae8fc37aeae8fd20643faef0341fe5cf01c30f25f41d6bad28b1a8365

Request headers

Referer: https://heraldcourier.com/
Origin: https://heraldcourier.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:35:00 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 14:48:42 GMT
x-vcache: HIT
age: 195
etag: W/"654b9fca-1164b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 29242
service-worker-allowed: /

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 267 KB
65 KB 144ms
44ms Script
application/javascript 18.239.69.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.69.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-69-131.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 18:45:27 GMT
content-encoding: gzip
via: 1.1 3141f89cca62ae5784a211a8d1176d1c.cloudfront.net (CloudFront), 1.1 c3d7a569db567dde78a645781f9949a2.cloudfront.net (CloudFront)
last-modified: Mon, 13 Nov 2023 20:18:45 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, AMS58-P4
age: 3168
x-amz-server-side-encryption: AES256
etag: W/"2d08dd94de483579c1dc3f3783c06f6e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: tow0vguP45HmCKkGy83oUpJNna0rIZJvT3PciejZiIEb3R_jjZCLUQ==

GET
H2 200 heraldcourier.com.js Show response
bloximages.chicago2.vip.townnews.com/leetemplates.com/content/tncms/live/global/resources/scripts/falcon/ 6 KB
1 KB 372ms
219ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/leetemplates.com/content/tncms/live/global/resources/scripts/falcon/heraldcourier.com.js?_dc=1701718469

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98e6908a5e89a28d5a21b6a55aea42d340de41ac5e66083f1098d897c09cc792

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: MISS
cross-origin-resource-policy: cross-origin
last-modified: Mon, 04 Dec 2023 06:01:49 GMT
x-vcache: MISS
server: cloudflare
etag: W/"656d6b4d-1794"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b78a634fc-WAW
expires: Tue, 03 Dec 2024 19:38:16 GMT

GET
H2 200 owl.carousel.50dc41fa734414148ce4b489fd904c5f.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 41 KB
11 KB 182ms
63ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/owl.carousel.50dc41fa734414148ce4b489fd904c5f.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3386bb5a79ff2284d6557313c0ddd06b0a64b9bfb6daf9631aaf6d2343d219cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461222
cross-origin-resource-policy: cross-origin
last-modified: Thu, 09 Nov 2023 15:29:53 GMT
x-vcache: MISS
server: cloudflare
etag: W/"654cfaf1-a55f"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b282f34fc-WAW
expires: Sat, 09 Nov 2024 10:23:38 GMT

GET
H2 200 tnt.notify.a814fe612f2dcba9061edc229aeaf90b.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 3 KB
1 KB 64ms
62ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.notify.a814fe612f2dcba9061edc229aeaf90b.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4dc723b7dd6602e39eb50fa74c7df276cb468805f5fae7450b00b8a568973a09

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2307965
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Oct 2023 21:37:38 GMT
x-vcache: MISS
server: cloudflare
etag: W/"653c2da2-dbe"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823cdb1034fc-WAW
expires: Fri, 01 Nov 2024 06:15:46 GMT

GET
H2 200 tnt.notify.panel.bacbeac9a1ca6ee75b79b21a0e2e99f2.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 7 KB
2 KB 60ms
58ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69316bde85428108020829bb1b79e145922a983b6f5ba55c74c82f6f46de9938

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461221
cross-origin-resource-policy: cross-origin
last-modified: Thu, 09 Nov 2023 15:29:52 GMT
x-vcache: MISS
server: cloudflare
etag: W/"654cfaf0-1baf"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823cdb1234fc-WAW
expires: Wed, 27 Nov 2024 07:15:46 GMT

GET
H2 200 firebase-app.js Show response
www.gstatic.com/firebasejs/6.6.2/ 11 KB
4 KB 380ms
45ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/6.6.2/firebase-app.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b10a075758097bb0578287af03c76a9fcd82fa4607587109ae41fe2d24756600

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 02:28:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 148190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3945
x-xss-protection: 0
last-modified: Thu, 19 Sep 2019 21:11:52 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 02 Dec 2024 02:28:26 GMT

GET
H2 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/6.6.2/ 31 KB
9 KB 375ms
40ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/6.6.2/firebase-messaging.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5e55a21dfa3a20ceb298737c8f4c517a83d7960468c7f53b3f33c567bacff3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 18:56:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8653
x-xss-protection: 0
last-modified: Thu, 19 Sep 2019 21:11:54 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 18:56:42 GMT

GET
H2 200 messaging.js Show response
heraldcourier.com/shared-content/art/tncms/api/ 2 KB
1 KB 117ms
116ms Script
application/x-javascript 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/api/messaging.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: adfa39b53589a91e67b4d82766750bee32371b51438f41dfbd6da0764719370e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:37:34 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 41
etag: W/"65568d4d-9cb"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 885
service-worker-allowed: /

GET
H2 200 tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/ 207 B
253 B 229ms
110ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 368681
cross-origin-resource-policy: cross-origin
last-modified: Tue, 28 Nov 2023 17:50:08 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65662850-cf"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b78a434fc-WAW
expires: Fri, 29 Nov 2024 11:24:49 GMT

GET
H2 200 tracking.js Show response
heraldcourier.com/shared-content/art/tncms/ 3 KB
1 KB 219ms
219ms Script
application/x-javascript 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:35:22 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 173
etag: W/"65568d4d-a3a"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 1157
service-worker-allowed: /

GET
H2 200 prebid7.9.0.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/ 197 KB
61 KB 273ms
154ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77b109dd53ec2921d47af5eedcf39cbea8bc92bf8b59a970aa104c5ed2d5b3c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1717426
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:29 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9271-313f5"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b78a334fc-WAW
expires: Sun, 10 Nov 2024 06:31:57 GMT

GET
H2 200 lee.common.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/scripts/ 9 KB
3 KB 228ms
109ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/scripts/lee.common.js?_dc=1701414005

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2008966819bb51e24bb6cbf82ef28efeb4d678e20c3b61fc02bb5d45b45e74e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 269362
cross-origin-resource-policy: cross-origin
last-modified: Fri, 01 Dec 2023 07:00:05 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65698475-2459"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823b78a134fc-WAW
expires: Sat, 30 Nov 2024 07:05:29 GMT

GET
H2 200 fontawesome.568f3d1ab17b33ce05854081baadadac.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 268 KB
98 KB 69ms
67ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/fontawesome.568f3d1ab17b33ce05854081baadadac.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7976a9dfe57f9ba6972420500782258da674fcc523c2def08bb6a84ce275c4b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2969470
cross-origin-resource-policy: cross-origin
last-modified: Thu, 14 Sep 2023 21:59:36 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65038248-43130"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823cdb1334fc-WAW
expires: Wed, 18 Sep 2024 19:01:28 GMT

GET
H2 200 tracker.js Show response
heraldcourier.com/shared-content/art/stats/common/ 9 KB
3 KB 220ms
220ms Script
application/x-javascript 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/stats/common/tracker.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:34:16 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 08:22:23 GMT
x-vcache: HIT
age: 239
etag: W/"654b453f-2200"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 3224
service-worker-allowed: /

GET
H2 200 e0d66240-6be2-11ec-a380-ff649233b50f.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/custom/image/ 4 KB
4 KB 92ms
89ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/custom/image/e0d66240-6be2-11ec-a380-ff649233b50f.png

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e88bc41dfc3e11b318a5a3eeeb403b70f98705db64962f4647a3ad2cb9083aa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 260514
cf-polished: origFmt=png, origSize=5857
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="e0d66240-6be2-11ec-a380-ff649233b50f.webp"
content-length: 4166
cf-bgj: imgq:85,h2pri
last-modified: Sun, 02 Jan 2022 15:44:32 GMT
server: cloudflare
x-vcache: MISS
etag: "61d1c860-16e1"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823b98c634fc-WAW
expires: Sat, 30 Nov 2024 08:25:32 GMT

GET
H2 200 user_no_avatar.82c8fc38eb25dca10493a994ca1bfb90.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/images/ 978 B
1 KB 62ms
61ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/images/user_no_avatar.82c8fc38eb25dca10493a994ca1bfb90.png

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b96eb73da5fe3c20e4507bf752917f6d7978be8881c1dea934db282b028407d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 368681
cf-polished: origFmt=png, origSize=3610
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="user_no_avatar.webp"
content-length: 978
cf-bgj: imgq:85,h2pri
last-modified: Thu, 02 Apr 2015 21:53:54 GMT
server: cloudflare
x-vcache: MISS
etag: "551dba72-e1a"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823cdb1534fc-WAW
expires: Wed, 20 Nov 2024 21:53:19 GMT

GET
H2 200 logo-tagline.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/ 5 KB
5 KB 92ms
89ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/logo-tagline.png?_dc=1701414006

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c01c1e199879f8b72679cc4d402684ba9e88c21b633547adbae6ba03a617fdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 260514
cf-polished: origFmt=png, origSize=10949
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="logo-tagline.webp"
content-length: 5302
cf-bgj: imgq:85,h2pri
last-modified: Fri, 01 Dec 2023 07:00:06 GMT
server: cloudflare
x-vcache: MISS
etag: "65698476-2ac5"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823b98c734fc-WAW
expires: Sat, 30 Nov 2024 07:05:29 GMT

GET
H2 200 syd-logo.png
bloximages.chicago2.vip.townnews.com/central.leetemplates.com/content/tncms/live/global/resources/images/blocks/deal-widget/ 3 KB
3 KB 67ms
66ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/central.leetemplates.com/content/tncms/live/global/resources/images/blocks/deal-widget/syd-logo.png?_dc=23.12.04.02

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45782508a28c1f03ebbfd53a3f172c85e77877a18b612b6dd23819cdc35dc54f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 35418
cf-polished: origFmt=png, origSize=5232
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="syd-logo.webp"
content-length: 2988
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Sep 2020 18:46:10 GMT
server: cloudflare
x-vcache: MISS
etag: "5f7380f2-1470"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823cdb1734fc-WAW
expires: Tue, 03 Dec 2024 07:00:29 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/leeenterprises/ 49 KB
19 KB 479ms
46ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/op.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 999b83d9c05b96d1b048e5cbf8003d781e9c52f1e16fd39817df95ca2e1cbfa1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: Y1ZMhlpvR1eBwwpsnudmZ8GAzm0EPimW
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
date: Mon, 04 Dec 2023 18:54:36 GMT
x-amz-cf-pop: AMS1-P1
age: 2641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19290
x-amz-meta-git_commit: e09f10f
last-modified: Sat, 02 Dec 2023 21:50:10 GMT
server: AmazonS3
etag: "ced9df2b610dba8e94e3944c7acb9ecc"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: f-Lr5E0HPG4MzC5oUYpKzZBhoi9mVqw14ElFabShVA2vhxwHPPrhZA==

GET
H2 200 heraldcourier.com.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/pb-config/ 1 KB
435 B 55ms
55ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/pb-config/heraldcourier.com.js?_dc=1696436850

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76460f1cd530a92dcb3d35468233b10d40dcb0ea7595aceb225104e63c3b78bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 461222
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:30 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9272-5b9"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823c39ad34fc-WAW
expires: Thu, 03 Oct 2024 16:32:56 GMT

GET
H2 200 dfp.lazy.pbjs.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/ 17 KB
4 KB 56ms
56ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/dfp.lazy.pbjs.js?_dc=1696436849

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9453c81287d37b52d6364987b4fe7618de7f9761f3d6805432132efa7d5d2c60

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 522395
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:29 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9271-4477"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823c8a6734fc-WAW
expires: Tue, 19 Nov 2024 23:13:27 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 232 KB
78 KB 388ms
54ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

95e8b69ceb5dabfbd69c8bbdca03c9085c5496da61a4f75cc953bbb6e9c16f00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79482
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 19:38:16 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 92 KB
30 KB 468ms
133ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c996d21298b0a0185fee6ad94f426102f02015ea6d9ab1420b9fc09bd7f627bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30270
x-xss-protection: 0
server: cafe
etag: 517 / 19695 / 31079947 / config-hash: 17787931357026562509
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 04 Dec 2023 19:38:16 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 118ms
39ms XHR
application/javascript 18.239.69.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.69.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-69-131.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 b96dc0b769a91a3fe5483b063383b1c8.cloudfront.net (CloudFront)
date: Mon, 04 Dec 2023 13:20:52 GMT
x-amz-cf-pop: AMS58-P4
age: 22644
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: ZntXlu88gysZ63B6QStGO5J5EGiIoakFy7b5fupx60owL0qHQWbdzw==

GET
H2 200 3266 Show response
config.aps.amazon-adsystem.com/configs/ 505 B
780 B 375ms
41ms Script
application/javascript 18.238.243.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/3266
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-82.ams58.r.cloudfront.net
Software: CloudFront /
Resource Hash: 4b9d00cdddea53b43ce092a8545d5527689379561d18d6f925355562ab2f359e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 18:46:54 GMT
via: 1.1 9a04c6aa4d3f25ed242a525a7658d9ac.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS58-P1
age: 3082
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 505
x-amz-cf-id: QbqTi4ZTH4PF8rO9tM_s73Y-IBWM-icm2IgHL1r7hlEi_OvV91256Q==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
3 KB 40ms
40ms XHR
application/json 18.239.69.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3266&u=https%3A%2F%2Fheraldcourier.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.69.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-69-131.ams58.r.cloudfront.net
Software: Server /
Resource Hash: cab29d30666c18a6b431d25c7d278a299bdb3d7b87c81400a813beb3b5d286e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:34:23 GMT
via: 1.1 c3d7a569db567dde78a645781f9949a2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: AMS58-P4
age: 233
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 2334
x-amz-cf-id: zadg8I-xySZnHM8arBGAOkp4GerYWTrC3k3gQUcpOgmjiZzxEBHNSA==

GET
H2 200 tracker.gif
heraldcourier.com/shared-content/art/stats/common/ 0
145 B 116ms
116ms Image
image/gif 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heraldcourier.com/shared-content/art/stats/common/tracker.gif?tnms_rs=1600x1200x24&tnms_vtum=1&tnms_vt=1&tnms_vid=170171869643316001200285547581488&tnms_dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&tnms_upage=1&tnms_do=heraldcourier.com&tnms_uri=/&tnms_ref=&rt=1701718696434
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
last-modified: Thu, 16 Oct 2008 20:11:25 GMT
x-vcache: MISS
age: 0
etag: "48f79fed-0"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 546 KB
136 KB 443ms
110ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

658ba9017b2658528da4226e25355a51ae64431917521b4181afa81e9a7ca3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138692
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 19:38:16 GMT

GET
DATA 200
OK truncated
/ 75 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 serif-ds.woff2
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/ 26 KB
26 KB 155ms
55ms Font
application/font-woff2 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/serif-ds.woff2

Requested by

Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701414005

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f98e8196d88bff2a006872a05d79c2d695f6dda36e0aecdd0ace020207809f40

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701414005
Origin: https://heraldcourier.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 108926
cross-origin-resource-policy: cross-origin
content-length: 26164
last-modified: Thu, 30 Nov 2023 07:00:05 GMT
x-vcache: MISS
server: cloudflare
etag: "656832f5-6634"
vary: Accept-Encoding
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823d8ad63479-WAW
expires: Fri, 29 Nov 2024 12:21:23 GMT

GET
H2 200 656cf2608140c.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/8/94/894f1374-9222-11ee-aec7-13d74220979e/ 17 KB
17 KB 159ms
158ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/8/94/894f1374-9222-11ee-aec7-13d74220979e/656cf2608140c.image.jpg?crop=1175%2C661%2C0%2C551&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebaeac0c7976dbc942d5c49cc63b696b88c5ff8720a3ba86a4a6c156ccf1e32a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=19923
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656cf2608140c.webp"
cf-bgj: imgq:85,h2pri
last-modified: Sun, 03 Dec 2023 21:25:53 GMT
server: cloudflare
x-vcache: MISS
etag: "aa12337986f632cdef8ab813f1fa0d4e"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823d0b8334fc-WAW
expires: Tue, 03 Dec 2024 01:42:51 GMT

GET
H2 200 656bc2dee1156.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/9/0d/90de36b1-317e-5ac9-ad05-d6e37916ee99/ 18 KB
19 KB 58ms
57ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/9/0d/90de36b1-317e-5ac9-ad05-d6e37916ee99/656bc2dee1156.image.jpg?crop=1763%2C992%2C0%2C91&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3142810ad639796eb4e954508e1287a06b74ee2f3de55b75c871c6be0855857a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 24279
cf-polished: qual=85, origFmt=jpeg, origSize=20720
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656bc2dee1156.webp"
content-length: 18876
cf-bgj: imgq:85,h2pri
last-modified: Sat, 02 Dec 2023 23:50:58 GMT
server: cloudflare
x-vcache: MISS
etag: "af869682dda9667a6931d4a2f0eb8967"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823d0b8834fc-WAW
expires: Mon, 02 Dec 2024 06:16:46 GMT

GET
H2 200 656c0e1f5510d.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/2/11/2116d4ef-83fe-5d09-b880-3fb0228f5d65/ 17 KB
17 KB 68ms
67ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/2/11/2116d4ef-83fe-5d09-b880-3fb0228f5d65/656c0e1f5510d.image.jpg?crop=1630%2C917%2C0%2C177&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c4ac46a4c97af74d832fdeb350960947ba7b246e01731ab6864f4ef17fb7931

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 44712
cf-polished: origSize=17846, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 17615
cf-bgj: imgq:85,h2pri
last-modified: Sun, 03 Dec 2023 05:11:59 GMT
server: cloudflare
x-vcache: MISS
etag: "046743a061b0959379ded0211bae24c7"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823d0b8b34fc-WAW
expires: Mon, 02 Dec 2024 06:22:52 GMT

GET
H2 200 65068b85ebdf7.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/b5/db53f9be-8196-57ce-a0a9-e18bdb7c456e/ 20 KB
20 KB 170ms
169ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/b5/db53f9be-8196-57ce-a0a9-e18bdb7c456e/65068b85ebdf7.image.jpg?crop=800%2C450%2C0%2C42&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7824083749ab73e8e4bd875866cacf3db5420dfdaa923e1e4db753a86fb6686

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=20859, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 20641
cf-bgj: imgq:85,h2pri
last-modified: Sun, 17 Sep 2023 05:15:50 GMT
server: cloudflare
x-vcache: MISS
etag: "2bf726f4390fb5002afc630857b5a41c"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823d0b8c34fc-WAW
expires: Mon, 02 Dec 2024 16:36:20 GMT

GET
H2 200 656acc11d0ade.preview.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/f/d1/fd1ef9c9-ddad-516e-83b6-4bec33b964e1/ 64 KB
64 KB 270ms
269ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/f/d1/fd1ef9c9-ddad-516e-83b6-4bec33b964e1/656acc11d0ade.preview.png?crop=940%2C529%2C0%2C129&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c0d0e892ad6fb18074eda0d880790b80bb26768fa4dcbc8cf9d62fc2da82334

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=100991
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656acc11d0ade.webp"
cf-bgj: imgq:85,h2pri
last-modified: Sat, 02 Dec 2023 06:17:57 GMT
server: cloudflare
x-vcache: MISS
etag: "b270f81c7843dcc0a9b2c6c0c4fccd40"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823d0b8d34fc-WAW
expires: Sun, 01 Dec 2024 21:44:41 GMT

GET
H2 200 656b7f0485e5c.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/e/dc/edc4a277-a35d-58bc-91b1-bdce53320ddf/ 12 KB
12 KB 162ms
162ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/e/dc/edc4a277-a35d-58bc-91b1-bdce53320ddf/656b7f0485e5c.preview.jpg?crop=1763%2C992%2C0%2C91&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e19b91215830eb7f731ccd0eeed7170a6f9a1d5147003237152ac47f41ac23b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=13095
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656b7f0485e5c.webp"
cf-bgj: imgq:85,h2pri
last-modified: Sat, 02 Dec 2023 19:01:26 GMT
server: cloudflare
x-vcache: MISS
etag: "2a0e7829777394da610561fe6302e991"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823d0b9034fc-WAW
expires: Sun, 01 Dec 2024 19:34:57 GMT

GET
H2 200 65585683e817a.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/5/71/5713403d-4af4-5740-b891-3eeb73d431ff/ 17 KB
17 KB 163ms
163ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/5/71/5713403d-4af4-5740-b891-3eeb73d431ff/65585683e817a.image.jpg?crop=800%2C450%2C0%2C41&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

559fdcdead17645fda4bc010b73aaab06dd70a7974e6ec58bbf3168ac364a387

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=17705, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 17412
cf-bgj: imgq:85,h2pri
last-modified: Sat, 18 Nov 2023 06:15:32 GMT
server: cloudflare
x-vcache: MISS
etag: "e3a08126533da7ed5a3c92b67d694ee7"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823d0b9134fc-WAW
expires: Sun, 01 Dec 2024 13:30:25 GMT

GET
H2 200 64c0a8cc3291c.image.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/7d/07d01b4d-4b4b-527b-aebd-c89b3b0c0167/ 15 KB
15 KB 205ms
205ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/7d/07d01b4d-4b4b-527b-aebd-c89b3b0c0167/64c0a8cc3291c.image.png?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f65079c7844584bf156ebb99949a883280f65cc817eab327c170d766c2a4fa5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 241030
cf-polished: origFmt=png, origSize=18498
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="64c0a8cc3291c.webp"
content-length: 15462
cf-bgj: imgq:85,h2pri
last-modified: Wed, 26 Jul 2023 05:02:04 GMT
server: cloudflare
x-vcache: MISS
etag: "9035ad7cba3e6f502040cf01647323a9"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823ebe4d34fc-WAW
expires: Sat, 30 Nov 2024 08:26:19 GMT

GET
H2 200 6554627499b55.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/6c/d6c91e2f-099d-558b-ad0b-0aed38832a22/ 8 KB
8 KB 60ms
59ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/6c/d6c91e2f-099d-558b-ad0b-0aed38832a22/6554627499b55.image.jpg?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4212eef2876eb083a172b80c748943d9bc27361dfbc8268aa6ee786eee71c5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 358363
cf-polished: qual=85, origFmt=jpeg, origSize=9864
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="6554627499b55.webp"
content-length: 7740
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Nov 2023 06:17:24 GMT
server: cloudflare
x-vcache: MISS
etag: "aceb371e5ab61a1ebcdf398c2f943f35"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306823ebe4f34fc-WAW
expires: Fri, 29 Nov 2024 10:58:39 GMT

GET
H2 200 64ace55a38d5a.image.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6b/06bf355c-10c4-5ea5-a3e1-88032058e4be/ 59 KB
59 KB 116ms
116ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6b/06bf355c-10c4-5ea5-a3e1-88032058e4be/64ace55a38d5a.image.png?crop=600%2C338%2C0%2C13&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cb9ec628a3a88428ab0dd29413e716c930932b4175133aaaf33a9a69d6332da

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 358363
cf-polished: origFmt=png, origSize=119630
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="64ace55a38d5a.webp"
cf-bgj: imgq:85,h2pri
last-modified: Tue, 11 Jul 2023 05:15:06 GMT
server: cloudflare
x-vcache: MISS
etag: "f2d855a1f1bfa7e02e3762f4009489e6"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823ebe5034fc-WAW
expires: Wed, 27 Nov 2024 10:15:28 GMT

GET
H2 200 655462822cbb4.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/ba/aba13f18-a6c4-5a92-8146-b65244ea1764/ 13 KB
13 KB 62ms
62ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/ba/aba13f18-a6c4-5a92-8146-b65244ea1764/655462822cbb4.image.jpg?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dae66852e0a17c8a1bb1050b6e3c4f2c10e3aff0d390a59f4ae26a481ca53a9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 358363
cf-polished: origSize=13409, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Nov 2023 06:17:38 GMT
server: cloudflare
x-vcache: MISS
etag: "249d0c9d945d1040ac25931689e99eb2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306823ebe5234fc-WAW
expires: Thu, 28 Nov 2024 22:27:43 GMT

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 153ms
48ms Script
application/javascript 23.57.19.78
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.19.78 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-19-78.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Mon, 04 Dec 2023 19:53:16 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 39 KB
12 KB 146ms
43ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 02:08:58 GMT
content-encoding: gzip
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 62959
x-amz-server-side-encryption: AES256
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: Ai_WwY6HyAZRwv44_i5VeDgpk8Uha4Gj0ehl5ZcyopII-JcxSOtMGg==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 147ms
62ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fheraldcourier.com%2F&ref=&_it=amazon&partner_id=663
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 15:31:45 GMT
server: cloudflare
x-amz-request-id: 01CC8G5F16RM7B26
age: 319
etag: W/"13043c1bbaf21ccc6e8ed474a744d3f2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8306823f6f342c46-FRA
x-amz-id-2: HXRUR8HjAo6USwQLdtHY+PYQf8tGuqDCh/+7XnINsX6lV9HyCEeo0/fdHmm/D8O2xprGCoT8y84=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 151 KB
33 KB 136ms
52ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7571db16348512fc55b35102ce3699733cf0882f4b4fb3e652fa8db700c07fb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Nov 2023 11:19:25 GMT
server: cloudflare
x-amz-request-id: MZ1SMZNNQ03R32VH
age: 2706
etag: W/"53159e4ae3ffbda2ff6c0204350035be"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8306823f6d349034-FRA
x-amz-id-2: PTtuGVlW86/lw6DBxeOyPXzoTsgfLjDUnYK3grbWOmKV5vopn3rRgL9PbvYp5z6ECilDUFmMBNY=

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ 84 KB
31 KB 45ms
44ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3925658
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: AqGYhT5MPgUEsvDKYQgzHz6XR6WCnJix93SvnBN40GKdt2vuhNEfeA==

GET
H2 200 bl-b80957a-cf87881d.js Show response
tagan.adlightning.com/leeenterprises/ 87 KB
36 KB 57ms
57ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/bl-b80957a-cf87881d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb1109a3ec1d9f4415476dada2b0bd9bfe750fc0bb29a79869fc35cf8edfe1d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 22:23:19 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: f8hVxyzQmlEafLM7WD2oh8WnOL4pZPJd
x-amz-cf-pop: AMS1-P1
age: 162898
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 36577
x-amz-meta-git_commit: b80957a
last-modified: Sat, 02 Dec 2023 21:49:45 GMT
server: AmazonS3
etag: "84650a8c80aedd8a695fd848491aecca"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: XGj4lrf-YU3FzcuvgMeZON_CIEF4ufnpuuCrBWmGd3K2uE0xpUr4pQ==

GET
H2 200 656e24b9e0f08.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/2/27/227c7774-92d9-11ee-baa7-23ccff27299a/ 9 KB
9 KB 183ms
182ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/2/27/227c7774-92d9-11ee-baa7-23ccff27299a/656e24b9e0f08.image.jpg?crop=331%2C186%2C305%2C139&resize=331%2C186&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3770c645efabf8bb50f83cdac4a1d42cb39d17ec4068779749c2538c47919e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=10386
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656e24b9e0f08.webp"
content-length: 9358
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 19:12:57 GMT
server: cloudflare
x-vcache: MISS
etag: "3d42c8d13e29b9906256764b1c37f821"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306824018a434fc-WAW
expires: Tue, 03 Dec 2024 19:18:17 GMT

GET
H2 200 656df9f6f179f.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/3/da/3daf5339-6096-5b9a-9ee2-718a5f4bc8aa/ 9 KB
10 KB 167ms
166ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/3/da/3daf5339-6096-5b9a-9ee2-718a5f4bc8aa/656df9f6f179f.preview.jpg?crop=1632%2C918%2C88%2C237&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355c9a5fb4e0a4ff29c1472881fd6ee3003933d44792252a5cd5985675de862a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=9863, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 16:10:33 GMT
server: cloudflare
x-vcache: MISS
etag: "da0a4cb0cf97b29fe63722bee300912d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306824018ac34fc-WAW
expires: Tue, 03 Dec 2024 19:18:17 GMT

GET
H2 200 6014d9d82516d.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/c/31/c3138dd8-92d6-11ee-8e37-c319e9c2e3aa/ 11 KB
12 KB 185ms
185ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/c/31/c3138dd8-92d6-11ee-8e37-c319e9c2e3aa/6014d9d82516d.image.jpg?crop=800%2C450%2C0%2C41&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14f0cc1996dedbe97005c628c6ef5755e756f047cd1f154e981138e19a3591a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=11779, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 11653
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 18:55:58 GMT
server: cloudflare
x-vcache: MISS
etag: "ce648c283d669984573af416c8ba2627"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 8306824018b334fc-WAW
expires: Tue, 03 Dec 2024 19:11:16 GMT

GET
H2 200 656dcf68b163a.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/4/32/4329c0c5-7864-50ff-9018-041a89d34ef0/ 9 KB
9 KB 160ms
159ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/4/32/4329c0c5-7864-50ff-9018-041a89d34ef0/656dcf68b163a.preview.jpg?crop=1699%2C956%2C0%2C132&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9456f051085b88b56a9b3d3f1b180eded38e4e51c8d76961e67a11b8dbb9f59

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=9470
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656dcf68b163a.webp"
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 13:08:58 GMT
server: cloudflare
x-vcache: MISS
etag: "14514bc21ae3237f8a5fee5f4cf4cad1"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306824018ba34fc-WAW
expires: Tue, 03 Dec 2024 16:27:25 GMT

GET
H2 200 656dcd55f1bcc.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/a1/da1420d0-4839-57d8-92cd-63d0a1127a7c/ 10 KB
10 KB 170ms
169ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/a1/da1420d0-4839-57d8-92cd-63d0a1127a7c/656dcd55f1bcc.preview.jpg?crop=1609%2C905%2C0%2C191&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e855db7e85c20e23c01cfea41de3cb4667a9098f8acf96c0d92c56d8e0055da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=10184
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656dcd55f1bcc.webp"
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 13:00:08 GMT
server: cloudflare
x-vcache: MISS
etag: "4352ce456d033a5265fe8de93da014ff"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306824018c034fc-WAW
expires: Tue, 03 Dec 2024 14:38:13 GMT

GET
H2 200 656dca9f0c2f8.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/7/77/777971e4-aa00-57ed-8697-04d1fa1c450d/ 5 KB
5 KB 178ms
178ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/7/77/777971e4-aa00-57ed-8697-04d1fa1c450d/656dca9f0c2f8.preview.jpg?crop=1763%2C992%2C0%2C91&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ab9512cb3b702e2e31ac2a18526bc99d80d492b4cdc7820700832faeedb4426

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=6248
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656dca9f0c2f8.webp"
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Dec 2023 12:48:33 GMT
server: cloudflare
x-vcache: MISS
etag: "81279302e27100050fb56aafcfb9de53"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 8306824018c434fc-WAW
expires: Tue, 03 Dec 2024 13:47:06 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 102 B
291 B 146ms
145ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=663&sync=0&domain=heraldcourier.com&url=https://heraldcourier.com/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fheraldcourier.com%2F&ref=&_it=amazon&partner_id=663
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e208efd3bc7196c5db30d0bf795cfb8513849fded1049006dce387cb818ebfc9

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 83068241bcfd65c9-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 126ms
39ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 19:22:33 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 944
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Dec 2023 21:22:33 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 180 KB
64 KB 60ms
60ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0122e9f2e59f9251d6f7b9bbdb74262a097e0d753d50347fa4d5559b883c49a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65095
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 217 KB
69 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2199c574519177285f697c62ca66e9d1d90f8b1238dd3d4a7e8d9970e836116d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70611
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/ 432 KB
135 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c417bdd5756646f7102a004458c6aa90e7a4c7ff04631494f0a9b8099619343d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 11:36:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28921
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138293
x-xss-protection: 0
server: cafe
etag: 11350998454379829730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 03 Dec 2024 11:36:16 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 182ms
55ms XHR
application/json 54.216.8.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.8.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-8-15.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 953af41def7be73c21fba2b47e04ede6dbfe0953f42b9f4c3cf310455b7fabb6

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache
x-server: 10.45.22.220
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/ Frame FCB5
Redirect Chain

https://insight.adsrvr.org/tags/nebsjkp/21usqg2/iframe
https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

138 B
668 B

141ms
39ms

Document
text/html

18.238.17.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.17.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-17-128.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f7d4fce911e0a58ed4224b9f65d90a98d8bb7b76d25ad2610485b9baaa1d447

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 63954
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 138
Content-Type: text/html
Date: Mon, 04 Dec 2023 01:52:24 GMT
ETag: "50351b1f6590b5c4886c111874e016a0"
Last-Modified: Fri, 01 Oct 2021 23:50:10 GMT
Server: AmazonS3
Via: 1.1 a6f8e4a6d80386054febd47005eabaca.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cfQBpA_ruK8_NqJWZpzoqMRN_opahV9XkZZpV3jkHq4axCCC40Jqrg==
X-Amz-Cf-Pop: AMS58-P1
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 0
date: Mon, 04 Dec 2023 19:38:17 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 233ms
141ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=663&sync=0&domain=heraldcourier.com&url=https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://heraldcourier.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 83068240db9065c9-FRA
content-length: 0
content-type: application/json
date: Mon, 04 Dec 2023 19:38:17 GMT
debug: OPTIONS block
expires: Tue, 03 Dec 2024 19:38:17 GMT
server: cloudflare

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 122ms
40ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 04 Dec 2023 19:38:17 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: voGMytetzNKFiYoFxzlxy0JmVYDp9w/QZaqin8sus3eFWC3vVnqpZLMCoXRHdRcHQ/UESz23KPZzK15pWBG1YA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 5b5dc540-ca6c-013a-51e3-0cc47a8ffaac Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 154ms
46ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/5b5dc540-ca6c-013a-51e3-0cc47a8ffaac
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 57f295553fdda2a7f1ee0e5dab92d82f2bace1df0a781117dee1cb06eacbf891

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
x-request-id: F524I5SGndDqiHcp8wkC
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 263 KB
89 KB 54ms
54ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

459c4809edef91bbb44e8cd0bb4758c885b557521852976d87e6781e10227296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90900
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 p.js Show response
cdn.parsely.com/keys/heraldcourier.com/ 57 KB
21 KB 129ms
44ms Script
application/javascript 13.227.217.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/heraldcourier.com/p.js?gtm_ver=3.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.217.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-217-72.ams54.r.cloudfront.net
Software: nginx /
Resource Hash: 4c0867ff49805574426a7a89e712807767fa9b2452c526736947e2b897a080ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: public
date: Mon, 04 Dec 2023 09:04:55 GMT
content-encoding: gzip
via: 1.1 1b0117d337408839a32bf2a49b55b3f0.cloudfront.net (CloudFront)
last-modified: Mon, 09 Oct 2023 15:21:06 GMT
server: nginx
x-amz-cf-pop: AMS54-C1
age: 38002
etag: W/"65241a62-e28b"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400, public
x-amz-cf-id: 9VB9A1jh7A32mjymKyI5jpT1YJ9-PxzzTO73NPPBt9ArGk5LJ_ewuQ==
expires: Tue, 05 Dec 2023 09:04:55 GMT

GET
H2 200 a-058n.min.js Show response
b-code.liadm.com/ 47 KB
15 KB 146ms
48ms Script
application/javascript 2600:9000:225e:a200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-058n.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:a200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a2abf60298591077c6d5b81d97380295dd942ef36095adf4de1ee06f90077545

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 09:20:32 GMT
content-encoding: gzip
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 37065
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: v75X4BNemVV80vF9Nj0w5RYd_u1DUDL7_9nNHWUzk5AAoytT3TCpqQ==

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma1527/lee/5/
Redirect Chain

https://js.matheranalytics.com/s/ma1527/725149306/lee/ml.js?cb=1641
https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js

145 KB
42 KB

41ms
41ms

Script
application/x-javascript

107.178.250.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8e69c64655718315422d63e22bc7dddaacd2fe1e1ceb20a6758287a76b9c6f66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 08:38:25 GMT
content-encoding: br
via: 1.1 google
last-modified: Wed, 04 Aug 2021 03:52:13 GMT
server: nginx
age: 39592
etag: "96d23de5d1ede166c2abc188adf1ebd7"
vary: Accept-Encoding
x-cache: HIT Sun, 18 Dec 2022 05:54:02 GMT
content-type: application/x-javascript
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43093

Redirect headers

date: Mon, 04 Dec 2023 19:38:17 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js
cache-control: public, max-age=269200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by: 6-gc-europe-west6-8j341034

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 107 KB
29 KB 143ms
44ms Script
text/javascript 13.227.222.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.222.191 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-222-191.ams54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1186699d4cc78d7acd98f87883b1434fa96f46c29aafba60659b1f97814fd3d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: hsqC1M3zTyLz6Qc8AwMehTiEPIw.GNBf
content-encoding: br
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
date: Mon, 04 Dec 2023 19:37:58 GMT
x-amz-cf-pop: AMS54-C1
age: 20
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 16 Nov 2023 19:51:47 GMT
server: AmazonS3
etag: W/"dbada6b699a28dea7a0791c760c06cca"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=120
vary: Accept-Encoding
x-amz-cf-id: JNj4mkBqg8qbOpnokMdWKxaFsn_fkXUrfDdFSG9WZjhSZtpmifuWUg==

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 256 KB
87 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0380bf582f2be39c9be28052559c68648e973fa35a3e38cab5a9e1d0bd3aed58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Dec 2023 19:38:17 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
255 B 133ms
46ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S5LKEZJN96&gtm=45je3bt0v893785645z86749731&_p=1701718696282&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=539967043.1701718697&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701718697&sct=1&seg=0&dl=https%3A%2F%2Fheraldcourier.com%2F&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&en=page_view&_fv=1&_nsi=1&_ss=1&ep.domain=heraldcourier.com&ep.asset_flag_array=false&ep.asset_tag_array=false&ep.page_type=homepage&ep.platform=desktop&ep.application=editorial&ep.byline=Undefined&ep.syndication_domain=null&ep.blox_sections=&ep.url_fragment=&ep.author=Undefined&ep.eedition_view_type=Page%20View&ep.asset_app=editorial&ep.asset_has_paywall=notset&ep.asset_has_video=no&up.user_status=anonymous&up.user_subscription=No&up.user_ppid=&up.user_uuid=false&up.user_subscription_date=false&tfd=2894
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 144ms
48ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S5LKEZJN96&cid=539967043.1701718697&gtm=45je3bt0v893785645z86749731&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 156ms
67ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S5LKEZJN96&cid=539967043.1701718697&gtm=45je3bt0v893785645z86749731&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1775516531

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
505 B 256ms
97ms XHR
text/javascript 52.84.179.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3266&u=https%3A%2F%2Fheraldcourier.com%2F&pid=f3MaZjjJrdehT&cb=0&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22breakout_top%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F8438%2Fheraldcourier.com%2Fhomepage%22%7D%5D&pj=%7B%22sections%22%3A%22%22%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.179.168 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-179-168.cdg50.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 fcba64af08748c3d9b1a3ae3aeed39c0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG50-P1
x-amz-rid: E0AHTPW4WGWG05APRGTB
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: T_rSuc_eOPyy9sFl3JIQkdsLpSFUjZLidwwpOjuZMzoP38PAdQVP4w==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
505 B 238ms
83ms XHR
text/javascript 52.84.179.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3266&u=https%3A%2F%2Fheraldcourier.com%2F&pid=f3MaZjjJrdehT&cb=1&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22breakout_middle%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F8438%2Fheraldcourier.com%2Fhomepage%22%7D%5D&pj=%7B%22sections%22%3A%22%22%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.179.168 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-179-168.cdg50.r.cloudfront.net

Software

Server /

Resource Hash

8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 fcba64af08748c3d9b1a3ae3aeed39c0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG50-P1
x-amz-rid: JKV5Z840JZDWG64GPREE
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: vLhB00GJ7_XhK81hPEwvxJkS_OKbSyZ2e-A9Ds_oEqnKqz0_CoHOlQ==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
33 KB 53ms
52ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Nov 2023 11:19:25 GMT
server: cloudflare
x-amz-request-id: 53GGBM5A6XBRJD2W
age: 2321
etag: W/"d12fc51ceb66081fc72dabad6e4e0ded"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 83068241a8279034-FRA
x-amz-id-2: +r3IAnmtspceOaG1P4pbsdXEsJtBBACfmiF8uWKvw4Pf0lwmAmf71J80yWQcWt5hYVJvZ/iixAE=

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 131ms
49ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 41455
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230032-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ekArsgd8beAgtK0jkfEuDRf7gGtVF3sn0Hw9AiAtHQS7WPwlyEeMvPja1t9YM%2FKg9vEVxirCZgvbO1%2FWWKLVq5Tm%2FVC1uwvkJq1NwqiPo5h%2BeCT5lFZ4hvenNuSzItdxWe4pkHRM1nJg7ok%2BB%2F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 830682422f702bc1-FRA

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 140ms
39ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 20:22:56 GMT
content-encoding: gzip
age: 170121
x-guploader-uploadid: ABPtcPre1U4HiY6WqF30zs-7H3NGrszEnSHbVnFT27X9GVDOMMChzfZ-c1a__e4CGhqxzvKP3jY
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Sun, 01 Dec 2024 20:22:56 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 137ms
52ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 05 Dec 2023 19:38:17 GMT

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 150ms
39ms Script
text/javascript 2600:9000:2447:9200:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2447:9200:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Mon, 04 Dec 2023 10:03:28 GMT
Via: 1.1 eb5552d4fb69ca0d0578ffa97b7b08fa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS58-P5
Age: 34490
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: jKQ3VjtreuArk6Rg0jptn8V0pg8Qdt68Fo60-4PgWFwA2gM_KH4brw==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 140ms
55ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 8ab69ff9b97e177f57c6d73c1e89ffb8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 49ms
49ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 05:36:54 GMT
content-encoding: gzip
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 50484
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 4XOG5K53ZvJ0EPe2Y5tarP7DmHBkNMGpF8qz9moKLQQ526-0RTafqQ==

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 159ms
40ms Script
application/javascript 2600:9000:2090:200:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2090:200:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 18:45:59 GMT
via: 1.1 9929448596fb4faec2a082aabe759212.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: AMS58-P1
age: 3139
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: WBvXzpOtmfE6z6zAa5E5VyFj8LRNcuSUmVpbECAU0h62Y6oJP1dg0A==

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
16 KB 132ms
131ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=396032095620830&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=2x1&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701718697188&lmt=1701718469&adxs=799&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY4snassMxSABSAghkEhkKCnB1YmNpZC5vcmcY4snassMxSABSAghkEhgKCXlhaG9vLmNvbRjiydqywzFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEhcKCHJ0YmhvdXNlGOLJ2rLDMUgAUgIIZBIUCgVvcGVueBjiydqywzFIAFICCGQSGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGOLJ2rLDMUgAUgIIZA..&dlt=1701718696042&idt=1113&prev_scp=pos%3Dfixed-impact-top%2Catf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D8%26lee_hours%3D19%26lee_day%3D1&cust_params=amznbid%3D0%26amznp%3D0%26k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=744025060&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ceea651620891f4e4b4cce92f90c696e3da60c1b755d93adff13f0d2a5ff4d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16502
x-xss-protection: 0
google-lineitem-id: 6411102447
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138453862257
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 560 B
291 B 104ms
104ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=1598040245982374&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701718697193&lmt=1701718469&adxs=800&adys=1&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY4snassMxSABSAghkEhkKCnB1YmNpZC5vcmcY4snassMxSABSAghkEhgKCXlhaG9vLmNvbRjiydqywzFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEhcKCHJ0YmhvdXNlGOLJ2rLDMUgAUgIIZBIUCgVvcGVueBjiydqywzFIAFICCGQSGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGOLJ2rLDMUgAUgIIZA..&dlt=1701718696042&idt=1113&prev_scp=pos%3Dfixed-impact-bottom%2Cbtf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D6%26lee_hours%3D19%26lee_day%3D1&cust_params=amznbid%3D0%26amznp%3D0%26k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=626189969&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68dacdafab7ea3a286824d19f8ce35cdc568f99971c2d261e1be5a72ad3ea8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 261
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 234ms
234ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=3899896072725658&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=3x1&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701718697195&lmt=1701718469&adxs=1155&adys=1097&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=325x1&msz=325x1&fws=4&ohw=1600&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY4snassMxSABSAghkEhkKCnB1YmNpZC5vcmcY4snassMxSABSAghkEhgKCXlhaG9vLmNvbRjiydqywzFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEhcKCHJ0YmhvdXNlGOLJ2rLDMUgAUgIIZBIUCgVvcGVueBjiydqywzFIAFICCGQSGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGOLJ2rLDMUgAUgIIZA..&dlt=1701718696042&idt=1113&prev_scp=pos%3Dnative_ad_grid_v3%2Catf%2C50%26density%3Dstandard%26lee_group%3D2%26lee_hours%3D19%26lee_day%3D1&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=3133586711&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fcc71a59795a98106a3bab9737c0fce5d07d5080ce2e0832adf5f95b30f572f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13109
x-xss-protection: 0
google-lineitem-id: 6059470473
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138398577744
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 560 B
292 B 110ms
109ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=175591557468701&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=7x1&ifi=4&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701718697197&lmt=1701718469&adxs=120&adys=1783&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1360x1&msz=1360x1&fws=4&ohw=1600&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY4snassMxSABSAghkEhkKCnB1YmNpZC5vcmcY4snassMxSABSAghkEhgKCXlhaG9vLmNvbRjiydqywzFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEhcKCHJ0YmhvdXNlGOLJ2rLDMUgAUgIIZBIUCgVvcGVueBjiydqywzFIAFICCGQSGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGOLJ2rLDMUgAUgIIZA..&dlt=1701718696042&idt=1113&prev_scp=pos%3Dsponsor-banner-impact%2Cbtf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D6%26lee_hours%3D19%26lee_day%3D1&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=1077773998&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e6900c17cbc365c6535dbcae8530f85958776a43efa80fab83aeb23d502bb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 262
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 560 B
292 B 145ms
145ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=3523416758999192&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=5x1&ifi=5&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701718697199&lmt=1701718469&adxs=798&adys=6581&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY4snassMxSABSAghkEhkKCnB1YmNpZC5vcmcY4snassMxSABSAghkEhgKCXlhaG9vLmNvbRjiydqywzFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEhcKCHJ0YmhvdXNlGOLJ2rLDMUgAUgIIZBIUCgVvcGVueBjiydqywzFIAFICCGQSGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGOLJ2rLDMUgAUgIIZA..&dlt=1701718696042&idt=1113&prev_scp=pos%3Dmembers-impact%2Catf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D7%26lee_hours%3D19%26lee_day%3D1&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=2681755583&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86591a2be5e936bf53c1dcf1d099d14742db949caec4da8c39d159447ce74b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 262
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 673C 6 KB
3 KB 189ms
74ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 19:38:17 GMT
expires: Tue, 03 Dec 2024 19:38:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 18:48:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 04 Dec 2023 19:48:36 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
440 B 147ms
47ms XHR
application/json 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94
x-xss-protection: 0

GET
H/1.1 200
OK /
p1.parsely.com/px/ 43 B
229 B 243ms
56ms Image
image/gif 52.17.99.225
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/px/?rand=1701718697240&plid=dd8ae974-0271-4b46-93a6-0729f502048e&idsite=heraldcourier.com&url=https%3A%2F%2Fheraldcourier.com%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22user_subscription%22%3A%22No%22%7D&sid=1&surl=https%3A%2F%2Fheraldcourier.com%2F&sref=&sts=1701718697229&slts=0&title=Bristol+Herald+Courier+%7C+Breaking+News+%7C+%7C+Read+Bristol%2C+VA+and+Virginia+breaking+news.+Get+latest+news%2C+events+and+information+on+Virginia+sports%2C+weather%2C+entertainment+and+lifestyles&date=Mon+Dec+04+2023+20%3A38%3A17+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=d5590c88-8cd6-4bd4-8e32-a5d26bffe225&u=pid%3D40510332-4f85-44a7-bc0d-23309b748fa9
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.99.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-99-225.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 19:38:17 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 4 KB
1 KB 116ms
38ms Fetch
application/json 13.227.222.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/settings
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.222.191 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-222-191.ams54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eec1d339b9dac9ef9991e418a6fd71c2cf953d77ed1597ed68f82fcc12bf7767

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: 8wBdC1fvjthSTrFspxDO4VzVvdAFdrfL
content-encoding: gzip
via: 1.1 d2322e4264977966de69a888b2e0eba8.cloudfront.net (CloudFront)
date: Mon, 04 Dec 2023 18:36:05 GMT
x-amz-cf-pop: AMS54-C1
age: 3733
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 09 Oct 2023 16:01:47 GMT
server: AmazonS3
etag: W/"b1f2fbddf3135863ad45acc993d27497"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=10800
vary: Accept-Encoding
x-amz-cf-id: lufsGq7rfZ01Dl2uC4M7NaVusoU8RGtZvufYRxb7uSZIZigG5mqiCA==

GET
H2 200 961211893969940 Show response
connect.facebook.net/signals/config/ 144 KB
37 KB 201ms
200ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/961211893969940?v=2.9.138&r=stable&domain=heraldcourier.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

53046268ca94dd29b29f2595bbe6a5ab8356f0e03956f4276f954979cdedfe94

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 04 Dec 2023 19:38:17 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 4LzotoZPRoi4YETFuS2E+izymYIM7d7kBMHEa/ifWV9RN1TdrBdx1EHS8KTkuBTe23GdKlt9NUrbTMVmwXzlwg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 46ms
46ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-4T2EB147B8&gtm=45je3bt0v887101457z8861227858&_p=1701718696282&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=539967043.1701718697&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dt=heraldcourier.com%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&dl=https%3A%2F%2Fheraldcourier.com%2F&sid=1701718697&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.canonical_url=https%3A%2F%2Fheraldcourier.com%2F&ep.townnews_crm_group_id=272&ep.generator=BLOX&ep.generator_version=1.71.9&tfd=3028
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
54 B 48ms
48ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-4T2EB147B8&cid=539967043.1701718697&gtm=45je3bt0v887101457z8861227858&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 65ms
65ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-4T2EB147B8&cid=539967043.1701718697&gtm=45je3bt0v887101457z8861227858&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=494060372

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
233 B 133ms
40ms XHR
text/plain 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
334 B 55ms
54ms XHR
application/json 54.216.8.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.8.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-8-15.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: d0cd2abb3d54b938e438d71bf16f25757511f1238b4195e8ad1ea918f0d3b57a

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache
x-server: 10.45.6.99
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 494ms
118ms Image
image/gif 54.198.156.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sec=homepage&pubname=The%20Bristol%20Herald%20Courier&ptype=homepage&metered=0%7C3&cms=townnews%2Fblox&arttype=editorial&tv=js-3.0.136&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-60&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=5&tvcfg=lee&tid=1c92bec1-01d5-4e06-bddd-662ad20727c4&pid=86746f7f-0a07-4f68-b2c6-7bfcd2808506&dtm=1701718697312&qnm=_matherq&visible=1&tabid=88bdc6c6-10e3-49ef-9ccb-e5548da4f8f2&url=https%3A%2F%2Fheraldcourier.com%2F&vp=1600x1200&ds=1600x6602&tofa=1701718697&vid=1&lvidt=1701718697&duid=fbad9b5544588046&fp=2142261801&cid=ma1527&mrk=725149306&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTcwMTcxODY5NDI1MyIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIyOS40bWIiLCJoZWFwVCI6IjM3LjNtYiIsImZzdFBhaW50IjoiMjIyOSIsImZldGNoUyI6IjEyMDkiLCJkb21haW5TIjoiMTMyOSIsImRvbWFpbkUiOiIxMzI5IiwiY29ublMiOiIxMzI5IiwiY29ubkUiOiIxNTYwIiwic3NsUyI6IjE0NDMiLCJyZXF1UyI6IjE1NjAiLCJyZXNwUyI6IjE3ODciLCJyZXNwRSI6IjE5MDIiLCJkb21Mb2FkIjoiMTc4OSIsImRvbUludGVyIjoiMjU4OCIsImRvbUxvYWRTIjoiMjU5MCIsImRvbUxvYWRFIjoiMjU5MyJ9LCJrZXl3b3JkcyI6WyJicmVha2luZyBuZXdzIiwid2VhdGhlciIsImNyaW1lIiwicG9saXRpY3MiLCJlbnRlcnRhaW5tZW50IiwibGlmZXN0eWxlcyIsInNwb3J0cyJdLCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjUzOTk2NzA0MyIsInJlZlRpbWUiOiIxNzAxNzE4Njk3MzExIn1dfQ
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.156.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-156-105.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Mon, 04 Dec 2023 19:38:17 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame F290 15 KB
6 KB 131ms
45ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=heraldcourier.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4563823fd629a48517c7feb8bf33640e12440e08bdde7a172ce477c2ddfc9c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 19:38:17 GMT
server: Kestrel
server-processing-duration-in-ticks: 392586
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1

85 B
202 B

152ms
152ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: ceee61a75f092110af27669da11aa1add96421879822930805a3b2e42c1ebdae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-Gs6T+zslSH5aJ3NIb5nW5s2O6w4"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Mon, 04 Dec 2023 19:38:17 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://heraldcourier.com
location: /esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame 6B57 84 KB
31 KB 43ms
43ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3925659
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: JxOUq4SrXm6B1hynuGIXcPhH2reuuyjvY-PISN2yTuoibB_l6QOqpA==

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6B57 202 KB
64 KB 161ms
75ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 19:38:17 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
369 B 162ms
47ms XHR
application/json 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 /
insight.adsrvr.org/track/pxl/ Frame FCB5 70 B
148 B 55ms
54ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=nebsjkp&ct=0:21usqg2&fmt=3
Requested by: Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 663 Show response
a.ad.gt/api/v1/u/matches/ 12 KB
4 KB 474ms
392ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/663?_it=amazon
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02ff16debc594a21ed69f9c4233032b8fdbcbd79b26f41a6bc20d0231ca2d12d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Mon, 04 Dec 2023 18:50:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 83068243cfe02c59-FRA

POST
H2 200 auction Show response
bidder.newspassid.com/openrtb2/ 132 B
765 B 445ms
146ms XHR
application/json 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/openrtb2/auction
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: 7b7c242b14d45300e4d7845715a58e317cb5b8df24b2593679d96fc48c36cb7b

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 132
expires: 0

POST
H2 200 auction Show response
bidder.newspassid.com/openrtb2/ 131 B
758 B 431ms
137ms XHR
application/json 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/openrtb2/auction
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e25c053415444bcb4037958dbc0267384ba680d874e6a27675e0591f3949f738

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 131
expires: 0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1701718697481&aid=a-058n&se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&tna=v2.11.1&pu=https%3A%2F%2Fheraldcourier.com%2F&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5...
https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&aid=a-058n&tna=v2.11.1&dtstmp=1701718697481&n3pc=true&wpn=lc-bundle&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&i6=...

50 B
356 B

481ms
118ms

XHR
application/json

34.206.108.117
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&aid=a-058n&tna=v2.11.1&dtstmp=1701718697481&n3pc=true&wpn=lc-bundle&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&i6=MmEwMTo0YTA6MTMzODo5Mjo6Nw%3D%3D&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0zIj5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTQiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xNSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE2Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTciPkNvbGxlY3Rpb248L3RpdGxlPg
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 34.206.108.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-108-117.compute-1.amazonaws.com
Software: /
Resource Hash: bf8a676a7f02c526c2946d58540257c34ef4a32ccd46787e08a031073b4ff642

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-pixel-event-id: 89d3175d-5bd6-4605-8261-1bbfebe169b4
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 50

Redirect headers

location: https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&aid=a-058n&tna=v2.11.1&dtstmp=1701718697481&n3pc=true&wpn=lc-bundle&ext__pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&i6=MmEwMTo0YTA6MTMzODo5Mjo6Nw%3D%3D&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0zIj5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTQiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xNSI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE2Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTciPkNvbGxlY3Rpb248L3RpdGxlPg
access-control-allow-origin: https://heraldcourier.com
date: Mon, 04 Dec 2023 19:38:17 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame 9E3C 84 KB
31 KB 42ms
41ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3925659
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: _9OSBZFjA5h-8mFiPqXxJxR7b3lQdQugADWY-pVQgC-C9VR1YvTwsQ==

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9E3C 202 KB
64 KB 168ms
146ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 ajs-destination.bundle.13362ca512563a10e34d.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 39ms
39ms Script
application/javascript 13.227.222.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.13362ca512563a10e34d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.222.191 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-222-191.ams54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7e4fde2a7e2da4eb11065a29f03b7f68566665515cf79bf4841168b46508dda5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 07:14:01 GMT
x-amz-version-id: 2vZJZXlIC0.RgEHs3cuB1kPrJjvqLcUy
content-encoding: br
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 649456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 21 Nov 2023 18:56:29 GMT
server: AmazonS3
etag: W/"0dec480089dae7da1834489f95aca4e7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: 6FBkNAzA1LscOpgM450EgHQMchi_Roqe7rfxsQM97reYZ5vevHZ4ww==

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
494 B 152ms
59ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e8588fd539779e736404cdd91e516fb1488cbdacc861fadeaf50f4c24b4b943

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 578260d6ae5bf2dfc69844e1132fc8a3
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
213 B 171ms
42ms XHR
application/json 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fheraldcourier.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
content-type: application/json
access-control-allow-credentials: true

GET
H2

200

sid Show response
mug.criteo.com/ Frame F290
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=heraldcourier.com&sn=ChromeSyncframe&so=0&topUrl=heraldcourier.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=MkQdvnwxb2QyeHFnUXJPTXNMZUVWYlh6T3Blc2pXTlVtWWhCNXBkYm9OeVd2VG9yNWV1MDJKK1dndUsxTlUwcXVHeDFwb055RFk2emZrSWxxR1JQQTlvOGZNdmMvZGhwK0hxOEVwMGJ6bDV0dGN3YVRpenJZOWhXTGFman...

467 B
678 B

44ms
44ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=MkQdvnwxb2QyeHFnUXJPTXNMZUVWYlh6T3Blc2pXTlVtWWhCNXBkYm9OeVd2VG9yNWV1MDJKK1dndUsxTlUwcXVHeDFwb055RFk2emZrSWxxR1JQQTlvOGZNdmMvZGhwK0hxOEVwMGJ6bDV0dGN3YVRpenJZOWhXTGFmanJhQXBXMkNscnZ6L3k2ZmgxaVlRbGczSVZUKzN2dW00aG9iQWV6eXYzVkVxQ254WlN6MUhUb01oZHdlcFlhcmFyc0thc2VqTVFGL213N0RkWHhSZFZrd3dnY0d3UVQ5K0JwcU83K1hDZjE5a0tObkNwbmdPamRNTmhVVUQwRGNKQzBwRFoySVhLUm5TZ1lNa0kzQk5mN2plbDNBYkk0VklvS0pEWjU2a1YzRE1teTlEakdmRT18&cppv=2

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ca996a497846f96d7007ff38ac5c8db1c53f79ee08c682b439919812247f5148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1148612
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:16 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=MkQdvnwxb2QyeHFnUXJPTXNMZUVWYlh6T3Blc2pXTlVtWWhCNXBkYm9OeVd2VG9yNWV1MDJKK1dndUsxTlUwcXVHeDFwb055RFk2emZrSWxxR1JQQTlvOGZNdmMvZGhwK0hxOEVwMGJ6bDV0dGN3YVRpenJZOWhXTGFmanJhQXBXMkNscnZ6L3k2ZmgxaVlRbGczSVZUKzN2dW00aG9iQWV6eXYzVkVxQ254WlN6MUhUb01oZHdlcFlhcmFyc0thc2VqTVFGL213N0RkWHhSZFZrd3dnY0d3UVQ5K0JwcU83K1hDZjE5a0tObkNwbmdPamRNTmhVVUQwRGNKQzBwRFoySVhLUm5TZ1lNa0kzQk5mN2plbDNBYkk0VklvS0pEWjU2a1YzRE1teTlEakdmRT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 238989
content-length: 0
expires: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6B57 0
0 79ms
78ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuZRhtvpb5aDxET4eHMrkwfAgC9dGO2zYWpZkakwZ7WS2zvOfBKd0NjwmZISVRi7UpUKfzpz1JRQZS5gZ3HYOrA236689M4wQ9reC7fO-JOcpLKwbsIFmbeszDrOJq5AGFs97PBpTWZLeZAq_VBlgf3hyPYTz4TOcbsYIqV7sADPpeLNQFcjrGoRK9qsqOQ73lg_wEEXVTs6pd7wUytorGL1NVPlFTVxl80nvRqxOMbMR8MbbsacQcTZPDDdZ-Bi7E-R4c207yLTvOpbxelkR0yzpI2KMdCmCmO_LXtZ6pAw0ExbUOTJ39px1I_pLB2U952peQHw_ANMkInAyanK8ARAqMdGeGqjQw&sai=AMfl-YRpkc0XkplhlopPVn607wXA4Aq-CrNHI10ERpeQHEyAs-8C3eJonAlX_WzTKFulERLBkJKn2dx3CcEmsjjkp1W8HF0sg0ysJGiOte_1FN7CKOI6DA7lN_zLlZ2LE-88mIXO2V5InT2TOUxcA41vIJbFexIpAA7Y-Cz0CQ&sig=Cg0ArKJSzEvMPT1zn1iVEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/ 52 KB
4 KB 130ms
49ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css

Requested by

Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2299077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3279
last-modified: Mon, 04 May 2020 16:04:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d2a-ce35"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wdZsSffGsU34cx4nTUGwCwLlZI5rxUTcyF9KJw8NFtiX1itfczTJ5NbvIrPULxKffLeScibce0ix7GdVMmzSSmVdKJ3T4NrlhSsSXqg5hZb%2Fq%2F4LlSz%2F02wvrcUllbaG3BU99kYlo41UlUbx6ceO%2F9WH"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 830682448a3d39e5-FRA
expires: Sat, 23 Nov 2024 19:38:17 GMT

GET
H3

200

1369886636433257115
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrf2_VRABGAEyCFhQrjHgP-WC
https://tpc.googlesyndication.com/simgad/1369886636433257115

152 KB
153 KB

40ms
40ms

Image
image/jpeg

2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1369886636433257115

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86660ef44d06ab8ca08059da26d814a85c5429eedd7c5f48c88bfcced3525fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 09:50:14 GMT
x-content-type-options: nosniff
age: 35283
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 156140
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 20:22:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Dec 2024 09:50:14 GMT

Redirect headers

date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://tpc.googlesyndication.com/simgad/1369886636433257115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 03 Jan 2024 19:38:17 GMT

GET
H2

200

4135096395794578540
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrfPo3AEQARgBMgjIkoSCyqD0Kw
https://tpc.googlesyndication.com/simgad/4135096395794578540

62 KB
63 KB

41ms
40ms

Image
image/jpeg

2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4135096395794578540

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101184683ffdeec2ca9f83c6f7416fceec9b7b7e9cda1957125aef24dd4179d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 00:05:15 GMT
x-content-type-options: nosniff
age: 156782
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63662
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 20:22:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 02 Dec 2024 00:05:15 GMT

Redirect headers

date: Mon, 04 Dec 2023 01:03:01 GMT
x-content-type-options: nosniff
server: cafe
age: 66916
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/4135096395794578540
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 03 Jan 2024 01:03:01 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 128ms
40ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=961211893969940&ev=PageView&dl=https%3A%2F%2Fheraldcourier.com%2F&rl=&if=false&ts=1701718697601&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701718697598.1003407637&cs_est=true&ler=empty&it=1701718697258&coo=false&rqm=GET

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 04 Dec 2023 19:38:17 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 128ms
40ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=961211893969940&ev=Domain&dl=https%3A%2F%2Fheraldcourier.com%2F&rl=&if=false&ts=1701718697601&cd[custom_param]=undefined&sw=1600&sh=1200&v=2.9.138&r=stable&ec=1&o=4126&fbp=fb.1.1701718697598.1003407637&ler=empty&it=1701718697258&coo=false&rqm=GET

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 04 Dec 2023 19:38:17 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 schemaFilter.bundle.f63551a29dc1697f71b6.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 38ms
38ms Script
application/javascript 13.227.222.191
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.f63551a29dc1697f71b6.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.222.191 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-222-191.ams54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 01:37:17 GMT
x-amz-version-id: Q83vlLXgyWB6DuTGnFxHLMCEzu8jknn5
content-encoding: br
via: 1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5421661
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 03 Oct 2023 01:26:38 GMT
server: AmazonS3
etag: W/"2a359f6227308e4ee31623f9381ae1d7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: 1bQNGzuEAUFKzh6n7Z9bvGV3KpC39xh7qhnxuBPur1-HekLjQaizUw==

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E3C 0
0 77ms
77ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst9HxopO0RpN9w4hOHAjaoZsfqbFm7QlH5ZPnkyCSll9P_WRpru5xO5tekzc3qX0GILnISXorNIbPRwxA1cqsJkOVdgeXCmrcWvYwvDyErjXRWeztF7ay9P74otO7bzH7AP3J_wgwlfBh-D8tW5psMU9EhTAw2Z25ZH8iHYjeebiCMMI1kJya0Kc0CvZrWAkT3HgcVzb1bbQWdzHqHAI8602M6xiXBCdvasi7O0umBI2FmiqgTvQ73x1ExP4FhteUgtfYqgkwTkJTkLDqdyBgOflaAfncPeW-KVn0ED2z_tclqGZgQJJ-JVr4YV-TCQj3inZ30i2LNBRXDgYEiovwYdRaZFVta-EMbVYMpvFfk39vFO2IJaDGHF37U&sai=AMfl-YQJtO9Pz8glM3v0hbuoe-BAlZ8q0O0z2bX3b_N0GSZQ4HgOawUEWQEcZwXeAan5P9zNjo19gE-XI_kFM1JG7NQddN0opxrg-oNC2iw6lCvqv_CIOa4xWEFlpeHeIJoQ0fFB0QTBkfXEjI0EFucDo4BRFcWNZOHv44ArSQ&sig=Cg0ArKJSzFjCyYIgMDKLEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ Frame 9E3C 619 KB
164 KB 184ms
58ms Script
application/x-javascript 23.2.235.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.2.235.168 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-235-168.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7310e401efd5214d7c4baf2a6df94becd6d945da0682fbc3a93274eadc68e8c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 19:38:17 GMT
Content-Encoding: gzip
x-amz-request-id: WN6CRNGBC7Q5EKK0
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: eOCsc9yceo4S4lv+W9OuH2eGmzxz+yVTuIOlwGlBoTdYajiqC8+FuFdyq8QUQV3rRTJN+M814is=
Last-Modified: Wed, 15 Nov 2023 00:44:41 GMT
Server: AmazonS3
ETag: "4fbba8ffe8ed5e2e12f43893b989ffc1"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 46ms
46ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=910284547&t=pageview&_s=1&dl=https%3A%2F%2Fheraldcourier.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgUAjAAQCACAAI~&jid=1934292811&gjid=926730289&cid=539967043.1701718697&tid=UA-54716522-7&_gid=492448081.1701718698&_slc=1&gtm=45He3bt0n71PDQV3Nv72758733&cd2=editorial&cd3=flex&cd4=flex-editorial&cd5=no&cd6=Large%3A%20Desktop%20computers.&cd8=200&cd9=No&cd10=No&cd12=No&cd13=https%3A%2F%2Fheraldcourier.com%2F&cd16=No&cd17=Page%20View&cm1=1033&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=384330812

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
148 B 48ms
48ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-54716522-7&cid=539967043.1701718697&jid=1934292811&gjid=926730289&_gid=492448081.1701718698&_u=aCDAgUAjAAQCAGAAI~&z=1233622555

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 46ms
46ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=910284547&t=pageview&_s=1&dl=https%3A%2F%2Fheraldcourier.com%2F&ul=en-us&de=UTF-8&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAiUAjBAQCAGAEKAB~&jid=2145165196&gjid=1306253996&cid=539967043.1701718697&tid=UA-54716522-2&_gid=492448081.1701718698&_slc=1&gtm=45He3bt0n71TDWDC2v6749731&cd1=desktop&cd2=heraldcourier.com&cd3=editorial&cd4=homepage&cd6=homepage&cd14=Undefined&cd17=null&cd20=anonymous&cd23=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cg1=&cd21=Bristol&cd22=flex-editorial&cd30=48&cd31=Mostly%20Cloudy&cd75=0&cd76=%20%20%20%20%20%20%20%20%20&cd79=&cd80=&cd81=No&cd82=&cd85=yes&cd86=no&cd102=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F119.0.6045.199%20safari%2F537.36&cd103=Undefined&cd104=Undefined%2C%20Undefined&cd105=3&cd106=Page%20View&cd107=0&cd111=undefined&cd115=notset&cd116=No&cd117=No&cd124=dsv3&cd129=0&cd130=no&cd89=539967043.1701718697&z=561392089

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
72 B 48ms
48ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-54716522-2&cid=539967043.1701718697&jid=2145165196&gjid=1306253996&_gid=492448081.1701718698&_u=aCDAiUAjBAQCAGAEKAB~&z=404639572

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
175 B 648ms
210ms Fetch
application/json 35.155.246.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.155.246.37 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-155-246-37.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Mon, 04 Dec 2023 19:38:18 GMT
strict-transport-security: max-age=31536000
content-length: 21
vary: Origin
content-type: application/json

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6B57 0
0 157ms
78ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsucA0gghFqtvd0FCDtq7eeB5nZwTeZykghnM9CLF3UBEPRuy1B9YarHfkZrQNQX9LvYFgsY7ACnjFtH_wreDQBVy58wBEpv3p6EzbyW5_NiY2snUF2nT9GxhYcjFfw9GanauIk89yaxdHTzLcxAv2nvVuabRO5lpz3IogKsMcRieTaN_1jK1rfFGenTdDURiWMhfheb3gkhzZb12Jlzg8MFPzxlcs_CeC7dyd9ZpEYFx4-coVwfVLju4sm0IcWkbYzyMltU4TW_cJ3JzRMB9lvd7OMkCaRvE8M2CTPHpZ8wVzOahueMf2KpwDVcJyK5Xt9eMaM2b4reZxuUIjJaaY58O6jqVeoEFs3LjQ&sai=AMfl-YR6SaS01_GbVxCv6-u8C6BspVXikpRf0oT1_cm99j1JWY56-XW01bAjk4o4Vg_5LL6OOjjVRbjrhs7jzu7ypA8JwL5fwNvUE1JyrvOV9mFG-F9cJQWMc39QI4kZY-LfxyG01aWjKgFT3VZjhM9zCA98hpJBt6q3fdY8tA&sig=Cg0ArKJSzACtQi2tQYPWEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:17 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 153ms
65ms Image
image/gif 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-54716522-2&cid=539967043.1701718697&jid=2145165196&_u=aCDAiUAjBAQCAGAEKAB~&z=318213262

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 66ms
65ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-54716522-2&cid=539967043.1701718697&jid=2145165196&_u=aCDAiUAjBAQCAGAEKAB~&z=318213262

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9E3C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eec3ef03fa30c8d0f116312a4b883d0becd32e3bf8d114ed70b0bae41d9e0380

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame E40B 0
176 B 153ms
49ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Mon, 04 Dec 2023 19:38:17 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
17 KB 690ms
689ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=537058278525928&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250%7C970x90%7C728x90&ifi=6&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D3e5983c88c2ed662%3AT%3D1701718697%3ART%3D1701718697%3AS%3DALNI_MaD-jUaOh8Lpy9WAI2NBSx11B_Tjg&gpic=UID%3D00000d035bf0b3e0%3AT%3D1701718697%3ART%3D1701718697%3AS%3DALNI_MYZBkO5db0eZnAqaBYCYYLO9dDtIQ&abxe=1&dt=1701718697917&lmt=1701718469&adxs=315&adys=780&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x250&msz=1600x250&fws=4&ohw=1600&psts=AOrYGsmQ8rhDHX2WAvmcMJt_ntvbZEb8FlhwXU7TGUwGwFJbvqrdWnx5shBRylc_uqCzqROmET9GpBtJ702TQebp%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslIqx2icDR5nabkQtf5My2sje-V74VJWzLX7lrPclJXgpojUwl_kuMQWo_B6617uMIR8hfyYcAi5ekenQKpRr3xbQ3Mig%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhgKCXlhaG9vLmNvbRi2zNqywzFIAFICCG8SGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGITM2rLDMUgAUgIIahIcCg1jcndkY250cmwubmV0GOLJ2rLDMUgAUgIIZBI7CgpwdWJjaWQub3JnEiQ5OTcxYThmZS1lY2NjLTRkYTctYjI4Zi1lYjVlMmQ4OTUxZTQY9crassMxSAASHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEsIBCghydGJob3VzZRKsAWcwV1B3Wi9EaklDbGFubGZDL1BEcFVWcTVTblNIck9RdXNRcTMyUUVaeHZQQVZ5cXJjWVA3VzZObzI0aHAwNjIzTjl2ZVlrb09MVGtLcXB5TXdLdTI0VFF3bFBvSTlKcGEvZ1ZrZHF6WU9kbERkTTdkVTFEK2o2K2h2cU1WQVZaajBPNmYwcTlMTmdjMzR2VXBVK3pJeXQ3UlRoandRWkZlVFg3d0twRjlCST0Yzc3assMxSAASPgoFb3BlbngSLGV5SnBJam9pUWpOdU5GaDRTWGxVUmpab05ESlhMMlp3YjFKbFp6MDlJbjA9GMvO2rLDMUgA&dlt=1701718696042&idt=1113&ppid=9971a8feeccc4da7b28feb5e2d8951e4&prev_scp=pos%3Dbreakout_top%2Cbtf%26density%3Dstandard%26lee_group%3D4%26lee_hours%3D19%26lee_day%3D1%26amznbid%3D2%26amznp%3D2&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=1369108146&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3f0881ce943117ed30a4e82a66d3773b70d9a908203a57de0c011566b4c4e6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17711
x-xss-protection: 0
google-lineitem-id: 6417910000
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138455125200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
17 KB 373ms
373ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4219398571930279&correlator=4216469644726087&eid=31079792%2C31079947%2C31079724%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250%7C970x90%7C728x90&ifi=7&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D3e5983c88c2ed662%3AT%3D1701718697%3ART%3D1701718697%3AS%3DALNI_MaD-jUaOh8Lpy9WAI2NBSx11B_Tjg&gpic=UID%3D00000d035bf0b3e0%3AT%3D1701718697%3ART%3D1701718697%3AS%3DALNI_MYZBkO5db0eZnAqaBYCYYLO9dDtIQ&abxe=1&dt=1701718697924&lmt=1701718469&adxs=315&adys=2181&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1584x250&msz=1584x250&fws=4&ohw=1600&psts=AOrYGsmQ8rhDHX2WAvmcMJt_ntvbZEb8FlhwXU7TGUwGwFJbvqrdWnx5shBRylc_uqCzqROmET9GpBtJ702TQebp%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslIqx2icDR5nabkQtf5My2sje-V74VJWzLX7lrPclJXgpojUwl_kuMQWo_B6617uMIR8hfyYcAi5ekenQKpRr3xbQ3Mig%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=539967043.1701718697&ga_sid=1701718697&ga_hid=910284547&ga_fc=true&a3p=EhgKCXlhaG9vLmNvbRi2zNqywzFIAFICCG8SGQoKdWlkYXBpLmNvbRjiydqywzFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGITM2rLDMUgAUgIIahIcCg1jcndkY250cmwubmV0GOLJ2rLDMUgAUgIIZBI7CgpwdWJjaWQub3JnEiQ5OTcxYThmZS1lY2NjLTRkYTctYjI4Zi1lYjVlMmQ4OTUxZTQY9crassMxSAASHQoOZXNwLmNyaXRlby5jb20Y4snassMxSABSAghkEsIBCghydGJob3VzZRKsAWcwV1B3Wi9EaklDbGFubGZDL1BEcFVWcTVTblNIck9RdXNRcTMyUUVaeHZQQVZ5cXJjWVA3VzZObzI0aHAwNjIzTjl2ZVlrb09MVGtLcXB5TXdLdTI0VFF3bFBvSTlKcGEvZ1ZrZHF6WU9kbERkTTdkVTFEK2o2K2h2cU1WQVZaajBPNmYwcTlMTmdjMzR2VXBVK3pJeXQ3UlRoandRWkZlVFg3d0twRjlCST0Yzc3assMxSAASPgoFb3BlbngSLGV5SnBJam9pUWpOdU5GaDRTWGxVUmpab05ESlhMMlp3YjFKbFp6MDlJbjA9GMvO2rLDMUgA&dlt=1701718696042&idt=1113&ppid=9971a8feeccc4da7b28feb5e2d8951e4&prev_scp=pos%3Dbreakout_middle%2Cbtf%2C60%26density%3Dstandard%26lee_group%3D10%26lee_hours%3D19%26lee_day%3D1%26amznbid%3D2%26amznp%3D2&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=3126890831&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86267a2e736cb47a9f96e983884d1a2333195cb7d1e37ba29eca3765a4e0c06f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17666
x-xss-protection: 0
google-lineitem-id: 6417910000
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138455125200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
heraldcourier.com/tncms/tracking/classifieds/featured/ 0
152 B 115ms
114ms Ping
application/octet-stream 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/tncms/tracking/classifieds/featured/?i=5e04d9e2-7168-5a0f-a307-a76402a7ac12,
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
real-hostname: heraldcourier.com
cache-control: s-maxage=0, private, no-cache
x-vcache: MISS
age: 0
content-length: 0
content-type: application/octet-stream

POST
H2 200 /
heraldcourier.com/tncms/tracking/business/block/ 0
152 B 115ms
115ms Ping
application/octet-stream 192.104.183.209
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/tncms/tracking/business/block/?i=4de8f754-3b35-5cbf-8541-f69f3f0d204a,f5f0e502-6ee2-5d5a-8dd6-059fa05a9c25,05a0bed8-78b6-54e8-bfdc-5ddf5bfaa5c8,
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.209 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
real-hostname: heraldcourier.com
cache-control: s-maxage=0, private, no-cache
x-vcache: MISS
age: 0
content-length: 0
content-type: application/octet-stream

GET
H2 200 display.js Show response
jadserve.postrelease.com/ Frame 9E3C 3 KB
2 KB 187ms
63ms Script
text/javascript 52.18.121.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/display.js?&ntv_m=1&ntv_z=native_ad_grid_v3&ntv_au=ntv2006667148&prx_url=https%3A%2F%2Fheraldcourier.com%2F&rand=212523472.5424854
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.121.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-121-48.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a79e2fb728c4d8d99bf24ddfe2c10ee101d2b20762b2d4060ca9a5506962fd55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: gzip
server: nginx
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 1174
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
277 B 136ms
40ms Fetch
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

597daf379001f8d7417edfd336da0b3cbf17e3125a0bf8749e0bb9606e2e17fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H2 200 v3 Show response
id5-sync.com/gm/ 317 B
600 B 120ms
40ms XHR
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

cbe9c0c9b4943f2b33d7f9a4294b07c1908172de4553e487c19439e5d3b410ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Mon, 04 Dec 2023 19:38:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 moatcontent.js Show response
z.moatads.com/nativonielsen548znrb18/ Frame 9E3C 167 KB
55 KB 202ms
45ms Script
application/x-javascript 23.43.61.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/nativonielsen548znrb18/moatcontent.js?moatClientLevel1=19446
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.61.119 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-61-119.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: gzip
last-modified: Mon, 24 Aug 2020 17:04:05 GMT
server: AmazonS3
x-amz-request-id: 755DFF1865089CD5
x-akamai-ew-subworker: 8096267
etag: "774acff2cee5852cdfc3fd8471cb2667"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=24989
accept-ranges: bytes
content-length: 55696
x-amz-id-2: dJSGZtrnr0X5nUYOm6+cFAUmCccOfgF6jjL0ZZS86DUbqlk3Cb8/135JFSKKp4qwcyjoBDWjpVE=

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
422 B 63ms
63ms Image
image/gif 52.18.121.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=188519&ntv_pl=1173341&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.121.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-121-48.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:18 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
422 B 58ms
58ms Image
image/gif 52.18.121.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=7862169e-6579-4fe1-bdff-bdaa22ddbde8&ntv_fl=BWZZiTvTzpc2ehvfNnYVIWqFRzCyGsChK0NiWXbOHwlCmY4onTPan4hunB4tcFJ-QdppqxnPFPDs_aj3s5lf3AxMLWXUQn4biGVF72ogWmLihJYXMhA8o1oc3OH8smuU0BoW7csQEH1WHaKRqZ_RSONTVqEP0Qs8TTKp2uzj6jKoDQO6LQi52L-uqXfpnuJssdOQrLdAtuuKssEwZIRzRFEyLh1Diohhd-0aBakEHdXO_7pk8BNskGmtWmwjEp5d_hkYwSa5J3bmVHDz4Y26EUCl94t1sf_98K-InYn2NGiXnWwOS1THm-EW_fKdv7FmijR1WxazQveMrL4tkGVQuf-jzyoSVR5vZngiDwjiWQ_EhI4Fx6k3PHCt3sRjpM1h&ntv_ht=qipuZQA&ntv_at=303,302&ntv_a=AAAAAAAAAAXecRA&ord=1701718698205&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F&ntv_it
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.121.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-121-48.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:18 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 privacyConsent
jadserve.postrelease.com/ 43 B
422 B 64ms
64ms Image
image/gif 52.18.121.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/privacyConsent?ntv_pl=1173341&ntv_gdpr_consent=&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F&ntv_it
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.121.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-121-48.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:18 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 161ms
75ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame B5B7 84 KB
31 KB 42ms
42ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3925660
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: uneMtJHAGus4AF_HOHQr-K5VrfGdHXuZQAhw4ddFijwjCaxLq3GpnA==

GET
H3 200 13124561810826208673
tpc.googlesyndication.com/simgad/ Frame B5B7 49 KB
49 KB 42ms
41ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13124561810826208673

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab37f0162374a31204d5f9b472406caf196aee2f662f8ec741bc063bbd22ca20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 22:05:44 GMT
x-content-type-options: nosniff
age: 77554
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50258
x-xss-protection: 0
last-modified: Wed, 22 Nov 2023 19:33:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 02 Dec 2024 22:05:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame B5B7 3 KB
1 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6783
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 17:45:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B5B7 0
0 48ms
47ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTi_ejhamnvj3QWg4Qlc74R1YtvggqsdmeHAxdb2zHvlirvydG1yqE-4MBSV87NSywsqS3a6iRsRCy9M5MQbOXHySFjbQ
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B5B7 202 KB
64 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 19:38:18 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B5B7 0
0 78ms
77ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvHsjYn_6yJ9b3PvAiR6SqwUcRjlphXf_Q-4ZF4e6x_EFPumHgkTllTQiubvv3WS61_BimuEQ_vlvQzdCqPu2rGN6cR-kC1LJdN4UBTRyyjfi1CtdKo33wweR-2FKfn0KTBMuIG2oKRAviQoaorL2v2v7K-NoGoZ-Vtq_dur7MFY15uOmq9_UskkvHJMFhE5iWR7vmneH-AFMWs1lXsdDYnBKrYiTMXhrzafF3w6-AV4CREoN92x_AY_-ciiRiiWtFAgmq8b9cCwJ7_z3yuLhbdQEWF9Zl00Q9xA_uzfRxdKU01ajlZVEblzudjgmbPQyxAfBIQMcKVmLICU6aglzYFqcejkqPCTJZdK3UU5LH_AxsHVfBS6GrkrrA&sai=AMfl-YTXfboPlBDyLwLmFZB5duBXnUrksOt9Sf1_4H0u3bSPIcJ6i6WhKTVXXaQin0Xp0kQIopyZTWkZpiJbNkmEFna29ktSGolR7l3c4oXTYmxLbVuOdBFvVuGc7b64lHlRzkyCCPeDRP6sgkzLZ6ySC0goZs6ruwVYSExA&sig=Cg0ArKJSzLlpSgE48RayEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK a-058n Show response
i.liadm.com/s/c/ Frame 10D3 583 B
865 B 494ms
122ms Document
text/html 50.17.66.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&euns=0&s=&version=v2.11.1&

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.17.66.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-17-66-232.compute-1.amazonaws.com

Software

Resource Hash

b98b5c6e0b77598589ebf0b7ea7489b18f16a71d7a2d81b85006948d1bf3d95e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 414
Content-Type: text/html; charset=UTF-8
Date: Mon, 04 Dec 2023 19:38:18 GMT
Request-Time: 4
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK baker
sli.heraldcourier.com/ 19 B
370 B 316ms
57ms Image
image/gif 2a02:26f0:2c::216:f221
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.heraldcourier.com/baker?dtstmp=1701718698469
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2c::216:f221 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Expires: Mon, 04 Dec 2023 19:38:18 GMT
Pragma: no-cache
Date: Mon, 04 Dec 2023 19:38:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame B5B7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed2834cdb21e88ae8b49e6be53114befff5403d859f52788f3634f0f1dc4fa11

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B5B7 0
0 77ms
77ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstoq2ANJnVcA9_0PAgeXQbelD1JXGD18VT1Us9hV-OMYgNY66PJEVSgJ7PAnO0Fx88cG2VPp_pM4-S-ydIRpipKjbpFVGy2Pt4PLlp44vkFaSticR2aMLGDfebqJCiNnRAHZiO4Skt3Hj3O5AOuSmNtN0_DsnMM_CER2kCFWEhbtCmhzJjHfq1ygiaV_X1tNr7hPufFOWVYhX14O8Rwi_jtYmPqBxbAkVZdpkTVKCypFRqc3f0Yr4MXL7bq1QTQ74BnEnP14qOmAmmWBjtO3aWNP1vYEcFG2EGArmA_KR0eQr3rJxMhZ4oUOp7kqTuttQG81PqgE9pDr_GRT2wFF-4ILEjpTGm_WDsA-3E9NAcZ7g1acjz4MB0AEEVxqA&sai=AMfl-YSE3TXWfJU2yM8J4_S2gV_C6PSQSDb8l4mYYqJd6PS-PwzlLE0vOaKOwxKt7Q6W5SRpiFLxdXU2Nj0BRVSpPip9jh9jAhcJurKT1Ug8oaFh3ToAKpcOS5a-xejQZl9e8sMGqWFl_Fyh2QIgy3JdS2Yf_VBsleq-t3ep&sig=Cg0ArKJSzNluXPbYMlY1EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:18 GMT

GET
H2 200 19446 Show response
s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/ 0
295 B 435ms
434ms Script
application/x-javascript 23.43.61.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/19446?t=2023114207
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.61.119 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-61-119.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 04 Dec 2023 19:38:18 GMT
last-modified: Tue, 18 Nov 2014 20:18:12 GMT
server: AmazonS3
x-amz-request-id: RXB852SNF9ZBAS48
x-akamai-ew-subworker: 8096267
etag: "d41d8cd98f00b204e9800998ecf8427e"
content-type: application/x-javascript
cache-control: max-age=1491
accept-ranges: bytes
content-length: 0
x-amz-id-2: UeVp5sMf5VE0kTvvUyx0sIqLMOe3UC2zqRy5kAev3yKfSJL/w3upGiFn9sH6u7hschmSqjDOGYE=

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9E3C 0
0 77ms
77ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstsB3db-yb5IPhZx_td3JBA4JREvUpul18zSo0IiWeSCUV6A0po_sMKyyEuVyGv328kH8yaJ4M1CDZWwoWDNwCpwFEeSF690XqSDVF6ki47tWJZWLV66OUABzv69RAIHDanH26HaGRQsRG6bPHGRXP_d9JUzGzyh-b3QAdtzxrtjVroW23XKPUcybCLMb6wamHgm2t9G1i-nQBpQXokU1GiGDc3E57ydGiccV96qGqq8VTI6ywTOvID8LVC8Mam0ZwxW9CTunj8vWc8EFxwQAc7pWBnW-VejlzsZa56XYogxJZh39hdxKg7v01R8t0HXHVDTqI_1aQtGoeZQh7X7veTN1c_uoASTvA6oJ3OkQcHosHcglCSbYHCL5ZSfA&sai=AMfl-YRDKIPwEFid9uOTb5tM4TDs58kw2d-x_vpiVd9d12uNGUVpTQanJwd5wZff1LPz3Dov6GSl_TQwBC9bGA03JRBJtEYPuUlizepQsWfiT71ACRaDAdgx_4n9i4ZM-vdz4FKk2Hr76Q7fk-l38L4m7YB_Lxx7yM8Okd6mmg&sig=Cg0ArKJSzJcUnpEe81NcEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:18 GMT

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame 806A 84 KB
31 KB 41ms
41ms Script
application/javascript 18.65.39.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-72.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3925660
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 7Hf5tx2QMaxawifsIr8YU2B07GE1uOL9phbDoQ7lW7aK_Yi1IOWAbw==

GET
H3 200 13124561810826208673
tpc.googlesyndication.com/simgad/ Frame 806A 49 KB
49 KB 39ms
39ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13124561810826208673

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab37f0162374a31204d5f9b472406caf196aee2f662f8ec741bc063bbd22ca20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 22:05:44 GMT
x-content-type-options: nosniff
age: 77554
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50258
x-xss-protection: 0
last-modified: Wed, 22 Nov 2023 19:33:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 02 Dec 2024 22:05:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 806A 3 KB
1 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6783
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 17:45:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 806A 0
0 47ms
46ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRnT0schN1kdh1LAzzd1udQfJGgLe6i1JR3B1x84VnUZ1GAPx4ggmMpjL6nkaJ2pUryrNJRSgepVq_0Pji5_raxSSyB0Q
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 806A 202 KB
64 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Dec 2023 19:38:18 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 806A 0
0 78ms
78ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss4KjJgoTlqeRYFI5yzr06zsoB2kViZDzFDRQyIKcq0Lw_D6g1ukgnvGjGF0792ls5fLnw-m1JUOOIP0YmTxHzng2K-YsenCUizUOuP9W1okW7eKUrfzsALXibtY_-kdXdqKNWPiSGABi7MYyNRFT5yP4Jnr-cOD7E5M-EjrbO4UT_eCvaNnuFpLyH7OkveUoNmEcBGr2UiosfKcviXzDKNi0WEqi5GL2IrtJpIwJdIzkoEmGS7TIdrt5WttR0D3VjYOXBpfY5K2i3fqcbA_RC8yhyAa80ksj_lW4v56g2yZSYwSX--0WaJ9lJTp-rgLVAMjK1Gyq34qxNYjHLsChYEXAZgnpf2-SqsQCY_huPP3Jx36Dm7GsBr_X8&sai=AMfl-YSknzFLoWJXDBCsRLlYdKfrqqzXRtsd6IHhcyOxGFvSSxyM_YKxW1oAONXi65ksXIZvR_Bau7Ql5_KIM2LRzYxuICzCZYFEfEIPZ4APAYn0SZeK6Zaeexgrjvq7qpmiA__0_TNV26iQWcN0Wskaqjqj7_cSiVLhWu-y&sig=Cg0ArKJSzCSX4svJHBf5EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 806A 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1dd0886c6750b35c648ebe184de9aee7ef8e45e497e5399957af74cf8628f505

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 806A 0
0 78ms
78ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu1Y4XU_EwB9ggoXZs-h5tCUHu63ZV1p_j1omBazBfBjje6HeBh1_nTOIBhjszUBI7mni9rGIPgk5yQl3a3xhLDOdYEruqkudJ2RKGyFiCZTCbQXpTWXTlPnIlG-RYBjWfCia5AIBnFuJCsDoX6RMNnmjhIjeqHs3eGT_lztAOvgwkLfZEAJ0xFQoKniPQnwfOWxcU4lJMnp4-hSzlmc1BsE4qDIVZtSotXhWCyCo57eBuhGFbK2bKTn_F7aR9-RDvzgbn79rm2yIhZKlA9pgIyI1oipUCDNmLDwoLPZubPUVN1r3xdBUMYjB4pcl8LrbcvoKaMR8vT7RrFcvmjxIzi5yTkWrFBho0piwYYxi9cDRwbfAUDR_RG3Wlh1g&sai=AMfl-YSlJGAroBE0d09q7Y1XBBQy4nSqQwyIM_IN6WyFqh6PSsnnvgtdTOmw83iFiS_HPMJUpK0ymfQGUpfhI068xYyk2ETZxursAYVOlYI4XA8L9U7d8T0YpAYw8R13whHHnwNqHuVSkco6Trmux4iR6epzMCqe3cNixnRb&sig=Cg0ArKJSzFRzkitBtfBNEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Dec 2023 19:38:18 GMT

GET
H/1.1

200
OK

28292
i.liadm.com/s/ Frame 10D3
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-B1iEHRBfhuRvYGeOL012vxX2wfcSru_SnWKRtQ

43 B
573 B

122ms
122ms

Image
image/gif

50.17.66.232
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-B1iEHRBfhuRvYGeOL012vxX2wfcSru_SnWKRtQ

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&euns=0&s=&version=v2.11.1&

Protocol

HTTP/1.1

Server

50.17.66.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-17-66-232.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Mon, 04 Dec 2023 19:38:19 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 4
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:18 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-B1iEHRBfhuRvYGeOL012vxX2wfcSru_SnWKRtQ
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 950384
content-length: 0
expires: Mon, 04 Dec 2023 00:00:00 GMT

GET
H/1.1 200
OK a-058n
i6.liadm.com/s/c/ Frame 10D3 0
0 497ms
117ms Image
text/html 2600:1f18:ed:550e:bb8f:8f68:a616:96a6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i6.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&version=v2.11.1&s=&euns=0
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd&euns=0&s=&version=v2.11.1&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:ed:550e:bb8f:8f68:a616:96a6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 91ms
90ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202312040101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js?cb=31079947

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35e78a5db949143ceca3d1a4c833e957ec2ffa8728c7c4b9f12d3ce1f8206e87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12331
x-xss-protection: 0

GET
H2 200 p Show response
i.simpli.fi/ 809 B
772 B 64ms
45ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=7855&cb=sifi_att_1768153694538195._hp
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 7e9cb3d5b8b7ca713c80a27af91c2a4632fdf41bfc609923e9da59b2ece9c77d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

/
s.ad.smaato.net/c/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=12431DACDBCF44CC90BB57EE850E30D8

0
236 B

198ms
79ms

Image
text/plain

2600:9000:25e8:1200:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 2600:9000:25e8:1200:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
cache-control: no-cache, must-revalidate
via: 1.1 cf3f18e8f11a6f190c72103c7a43aac2.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS1-P3
x-amz-cf-id: 8yR5QubEVOzLqIZFzAyWDB84mxWK_s7EQrh1muEOTKnsWjZHo2bVNg==
x-cache: Miss from cloudfront

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/12431DACDBCF44CC90BB57EE850E30D8
https://sync.1rx.io/usersync/simplifi/12431DACDBCF44CC90BB57EE850E30D8?zcc=1&cb=1701718699804
https://sync.targeting.unrulymedia.com/csync/RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003

43 B
378 B

160ms
44ms

Image
image/gif

46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003
Protocol: H2
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:20 GMT
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003
pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=12431DACDBCF44CC90BB57EE850E30D8&dongle=yf3

37 B
140 B

141ms
41ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=12431DACDBCF44CC90BB57EE850E30D8&dongle=yf3
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://eb2.3lift.com/xuid?mid=7969&xuid=12431DACDBCF44CC90BB57EE850E30D8&dongle=yf3
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=12431DACDBCF44CC90BB57EE850E30D8

43 B
175 B

429ms
118ms

Image
image/gif

2600:1f18:612b:4200:e43e:a85c:2848:83d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 2600:1f18:612b:4200:e43e:a85c:2848:83d Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 04 Dec 2023 19:38:20 GMT
server: nginx
content-type: image/gif

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://simplifi.partners.tremorhub.com/sync?UISF=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8

95 B
427 B

52ms
51ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=12431DACDBCF44CC90BB57EE850E30D8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=12431DACDBCF44CC90BB57EE850E30D8
https://d.agkn.com/pixel/10751/?che=1701718699812&ip=80.255.7.109&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217523104720004811406
https://um.simpli.fi/aa_px?sk=217523104720004811406
https://um.simpli.fi/empty.gif

43 B
361 B

44ms
44ms

Image
image/gif

35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43

Redirect headers

date: Mon, 04 Dec 2023 19:38:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: /empty.gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142

GET
H2

403

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=12431DACDBCF44CC90BB57EE850E30D8

0
0

129ms
39ms

Image
text/html

18.245.60.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 18.245.60.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-10.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 82ms
81ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 85ms
85ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

engine
pbid.pro-market.net/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=12431DACDBCF44CC90BB57EE850E30D8;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=12431DACDBCF44CC90BB57EE850E30D8;mimetype=img;sr
https://cm.g.doubleclick.net/pixel?google_nid=datonics-ddp&google_cm&google_hm=MzM4NzU4NjY2OTI3Mjc3OTA2NA==
https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEJHuv95ThkPOj-upDNuUwDI&google_cver=1

43 B
408 B

50ms
49ms

Image
image/gif

2600:1901:0:8eee::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEJHuv95ThkPOj-upDNuUwDI&google_cver=1
Protocol: H2
Server: 2600:1901:0:8eee:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
via: 1.1 google
server: Apache-Coyote/1.1
anserver: gapp-eu-4.c.datonics-gcp-01.internal
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 43
expires: Mon, 1 Jan 1990 0:0:0 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pbid.pro-market.net/engine?du=53&mimetype=img&google_gid=CAESEJHuv95ThkPOj-upDNuUwDI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 315
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0&xl8blockcheck=1

0
755 B

45ms
45ms

Image
text/plain

18.198.126.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0&xl8blockcheck=1
Protocol: H2
Server: 18.198.126.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-126-47.eu-central-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=12431DACDBCF44CC90BB57EE850E30D8&j=0&xl8blockcheck=1
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 88ms
88ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=12431DACDBCF44CC90BB57EE850E30D8

0
421 B

503ms
116ms

Image
text/plain

52.44.250.119
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=12431DACDBCF44CC90BB57EE850E30D8
Protocol: HTTP/1.1
Server: 52.44.250.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-250-119.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Connection: keep-alive
Date: Mon, 04 Dec 2023 19:38:19 GMT

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.bfmio.com/sync?pid=141&uid=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=12431DACDBCF44CC90BB57EE850E30D8

62 B
446 B

490ms
389ms

Image
image/gif

72.246.169.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 72.246.169.24 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-246-169-24.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Mon, 04 Dec 2023 19:38:20 GMT
content-length: 62
content-type: image/gif

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://stags.bluekai.com/site/29931?id=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

404

tpid=12431DACDBCF44CC90BB57EE850E30D8
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=12431DACDBCF44CC90BB57EE850E30D8

49 B
264 B

55ms
55ms

Image
image/gif

54.216.8.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 54.216.8.15 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-8-15.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.10.11
content-length: 49
expires: 0

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=12431DACDBCF44CC90BB57EE850E30D8

0
311 B

156ms
49ms

Image
text/plain

216.52.2.39
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=12431DACDBCF44CC90BB57EE850E30D8
Protocol: HTTP/1.1
Server: 216.52.2.39 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Expires: Fri, 20 Mar 2009 00:00:00 GMT
Pragma: no-cache
Date: Mon, 04 Dec 2023 19:38:19 GMT
X-MERGE: GDPR Optout true
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

451

419566.gif
idsync.rlcdn.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=12431DACDBCF44CC90BB57EE850E30D8

0
98 B

137ms
48ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/419566.gif?partner_uid=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://idsync.rlcdn.com/419566.gif?partner_uid=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701718699512&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=q...
https://www.google.com/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlM...
https://www.google.de/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlMT...

42 B
64 B

53ms
53ms

Image
image/gif

2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlMT2ggMV8pX9Bx1HBAYv&is_vtc=1&ocp_id=qypuZYHtJ_Kr9u8Px4iY-AI&cid=CAQSKQDICaaN6ZOaHkkUBHDpZwQD1cxMppVgiIncAACvX_1XMWvGcTCwTcHd&random=3272241776&ipr=y

Protocol

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/1026675585/?random=869456075&cv=7&fst=1701718699512&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIwe7mlMT2ggMV8pX9Bx1HBAYv&is_vtc=1&ocp_id=qypuZYHtJ_Kr9u8Px4iY-AI&cid=CAQSKQDICaaN6ZOaHkkUBHDpZwQD1cxMppVgiIncAACvX_1XMWvGcTCwTcHd&random=3272241776&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 89ms
89ms Image
text/plain 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=12431DACDBCF44CC90BB57EE850E30D8
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D12431DACDBCF44CC90BB57EE850E30D8

43 B
893 B

46ms
46ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D12431DACDBCF44CC90BB57EE850E30D8

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
an-x-request-uuid: 3c5973f0-d08a-440d-a837-141ffef04e35
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.109; 80.255.7.109; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
an-x-request-uuid: 15aef51c-42ee-4eaf-a157-a6de7770a1e4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D12431DACDBCF44CC90BB57EE850E30D8
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.109; 80.255.7.109; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=12431DACDBCF44CC90BB57EE850E30D8&expires=365

0
239 B

170ms
41ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=12431DACDBCF44CC90BB57EE850E30D8&expires=365
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=12431DACDBCF44CC90BB57EE850E30D8&expires=365
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=12431DACDBCF44CC90BB57EE850E30D8

43 B
201 B

68ms
48ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=12431DACDBCF44CC90BB57EE850E30D8
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=12431DACDBCF44CC90BB57EE850E30D8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 03 Dec 2023 19:38:19 GMT

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEN1zwhZK-uVsNIyJjG6Y5fA&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=12431DACDBCF44CC90BB57EE850E30D8
https://um.simpli.fi/g_match?id=

0
320 B

45ms
45ms

Image
text/plain

35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Sun, 03 Dec 2023 19:38:19 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://um.simpli.fi/g_match?id=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Dec 2023 19:38:19 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C3DC 13 KB
5 KB 39ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 6431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 17:51:08 GMT
expires: Tue, 03 Dec 2024 17:51:08 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9481 829 B
560 B 50ms
50ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ee2f5f86f89a5b0ea70fd58bfd838f8db82febe419d51e98e1c9e8f8a4df8046

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7xvFeYqiP4zW4ozqiUzqHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-7xvFeYqiP4zW4ozqiUzqHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 19:38:19 GMT
expires: Mon, 04 Dec 2023 19:38:19 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame C3DC 39 KB
15 KB 119ms
39ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 10:24:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 10:24:32 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9481 0
0 147ms
73ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202312040101&jk=4219398571930279&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 806A 42 B
64 B 75ms
75ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvl8DAhV2IPrQtH511J5Pdnl1zRNxPnOgBnZxfnuPzOjVTjEPyxTsudQOYwoVKLJxIdGYhcxUNh6LN9fjdBihPUGvRxLpR8fTkymKN-T2FccmXbDYzNG2VriI4Ra6T3cwl985BRH2dR8A&sai=AMfl-YRQltLSjYX95oiLkj4NzIjhWKel-UCDWVKmvS4oOHupcxk2Nkk&sig=Cg0ArKJSzJlEkMHjT0blEAE&id=lidar2&mcvt=1000&p=1072,436,1162,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=1369108146&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701718698618&rpt=162&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame C3DC 0
10 B 39ms
38ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?4Xugyg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:19 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 76ms
76ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202312040101&jk=4219398571930279&bg=!rK-lr-DNAAY3kmNgF5I7ADQBe5WfOJjbf_iKwocvLW45h3du6pxV0NDW9n0dJfC0fqU0v4HHOKlx7HTWs3Z_PN0vwZmmAgAAADRSAAAAAmgBB5kCyV_5YnbZT-_GR3PJG705Bw4iL4LZ-jMEgid8rcDnVN0Fzbe-56dOMWnqY5WA6hOdRm-MgNDZCZVagoERbTp98p1OHTdcyqproPI_61PvUFlL83A0h-qHsbsvfG29erStWsDHrpdahfz_QgLheYDmTvYV7nJSjCOYYOUdwdPM06LbtH7Nx1sm753GVqbbWQxnMAIrrBbuZ8xN6BI_y5quTuEMwyfEjkveMatQfdnuY6msdgRcgsA3imxgPxTsJjFj_rPQYnD2VAuD7dFEDc_aossvAwej_sGpkhPFvpfUc-3VxMalTdoV57jq0TensXfKYPKkQdTHjSnRXgf_oXhd9asnZDQtK5_BnuzkcUGWNA-21rrl9v5vc02KKSgkcqODXGGQmbQKctMtRmlNYbUXZoYalyNDBz0sikqWX27lQRAtIOYpV5JYjmjDyBGDOFJElMlr_atWL-iHF25VCl_kPLRRTdAjcwPEdoEDl2p6-aK_JP57yCf1r5NlZ7NMcn0v5nAnKMVDp90dhLG3A2M8EA7lwdwrO3XGASN_rDGgVm1Z_md-nr-YAiMRXFmJWv4jGJiMkhEoBLdQ3VPs7Cla5el7Gum2VqAQxTsnHPxL9cxrOaGdNMmUrkac1d8iyxsJTDSVZNwIrQr3MGj10moG3Ev5VrKZOGLiEto-3WOIRHWuB04xdmA1w9fCyhVNftlJ9rv1WwxqgY0MKSrhKn2rviWzp04x5JAfH67Qw3HIc76yzHuedApFrwj4jN2jsQffGMy3q3VPRk8Jex_UKXrohnIOBlG0Ol2F9IEK-Y_0mQSns-y2jpnAj-nWOdDOIGxudBI7lv95cTdNJfpryU3WzVAJLNgibatM3r-Q1UFQBX8hSYo7eGEIwx1703-YOK36N4Th1ZrvfmtHbeBcqxh9iMxU0yvk0-w_CV24AWcvKABp7sfLW6UTs90N
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 200 load-cookie.html Show response
bidder.newspassid.com/static/ Frame 27B1 12 KB
13 KB 119ms
118ms Document
text/html 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: 202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 12255
content-type: text/html; charset=utf-8
date: Mon, 04 Dec 2023 19:38:20 GMT
expires: 0
last-modified: Mon, 04 Dec 2023 10:33:06 GMT
pragma: no-cache
vary: Origin

GET
H2 200 load-cookie.html Show response
bidder.newspassid.com/static/ Frame BE29 12 KB
13 KB 234ms
234ms Document
text/html 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: 202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 12255
content-type: text/html; charset=utf-8
date: Mon, 04 Dec 2023 19:38:20 GMT
expires: 0
last-modified: Mon, 04 Dec 2023 10:33:06 GMT
pragma: no-cache
vary: Origin

POST
H2 200 cookie_sync Show response
bidder.newspassid.com/ Frame 27B1 3 KB
4 KB 118ms
117ms XHR
text/plain 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/cookie_sync
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: 0341c74d9a288f6cbf8ee66ad46c9605aba53b4d13ba62fa89c2462f8a71a783

Request headers

Referer: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
vary: Origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://bidder.newspassid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: 0

GET
H2

200

setuid
bidder.newspassid.com/ Frame 27B1
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D
https://bidder.newspassid.com/setuid?bidder=openx&uid=ed0b48c9-022a-4040-90b9-6d429be6e00a

0
774 B

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=openx&uid=ed0b48c9-022a-4040-90b9-6d429be6e00a
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://bidder.newspassid.com/setuid?bidder=openx&uid=ed0b48c9-022a-4040-90b9-6d429be6e00a
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117

POST
H2 200 cookie_sync Show response
bidder.newspassid.com/ Frame BE29 3 KB
4 KB 118ms
118ms XHR
text/plain 44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/cookie_sync
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: c56eaad58c865a0499996bfbe56d4fed19e68a1a2ef1b82bc64c95941e3754af

Request headers

Referer: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
vary: Origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://bidder.newspassid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: 0

GET
H2

200

setuid
bidder.newspassid.com/ Frame BE29
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813

0
757 B

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
an-x-request-uuid: c675433d-6061-4240-99fb-6f86b7d10696
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813
x-proxy-origin: 80.255.7.109; 80.255.7.109; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 server_match
ad2.360yield.com/ Frame BE29 43 B
199 B 235ms
56ms Image
image/gif 52.213.214.202
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad2.360yield.com/server_match?r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dimprovedigital%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%7BPUB_USER_ID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.213.214.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-214-202.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 04 Dec 2023 19:38:21 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

setuid
bidder.newspassid.com/ Frame 27B1
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432

0
871 B

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D22B 16 KB
6 KB 185ms
55ms Document
text/html 2.19.84.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&predirect=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26uid%3D
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.84.188 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-84-188.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://bidder.newspassid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=68114
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Mon, 04 Dec 2023 19:38:21 GMT
expires: Tue, 05 Dec 2023 14:33:35 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

setuid
bidder.newspassid.com/ Frame BE29
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-news...
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3

0
983 B

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3
date: Mon, 04 Dec 2023 19:38:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame D22B 0
42 B 144ms
41ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=54718576&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&predirect=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:21 GMT
content-length: 0

GET
H2

200

setuid
bidder.newspassid.com/ Frame BE29
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432

0
985 B

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=973184888815073815432
date: Mon, 04 Dec 2023 19:38:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

setuid
bidder.newspassid.com/ Frame 27B1
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813

0
1 KB

117ms
116ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:22 GMT
an-x-request-uuid: eda5cb05-27f1-4a5c-a3b5-f2416abe53b3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=4950480544048662813
x-proxy-origin: 80.255.7.109; 80.255.7.109; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame BE29 0
239 B 42ms
41ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-newspassid&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 27B1 0
277 B 170ms
53ms Image
text/plain 216.52.2.48

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 04 Dec 2023 19:38:22 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame BE29 0
277 B 155ms
54ms Image
text/plain 216.52.2.48

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 04 Dec 2023 19:38:22 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2 204 v1
match.sharethrough.com/universal/ Frame 27B1 0
35 B 278ms
41ms Image
text/plain 3.68.0.8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=1UfPRnxS&gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&redirectUri=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.0.8 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:22 GMT

GET
H2 204 v1
match.sharethrough.com/universal/ Frame BE29 0
34 B 278ms
42ms Image
text/plain 3.68.0.8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/universal/v1?supply_id=1UfPRnxS&gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&redirectUri=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.0.8 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:22 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 47ms
47ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S5LKEZJN96&gtm=45je3bt0v893785645z8887101457&_p=1701718696282&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=539967043.1701718697&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1701718697&sct=1&seg=0&dl=https%3A%2F%2Fheraldcourier.com%2F&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&_s=2&tfd=8209
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
bidder.newspassid.com/ Frame 27B1
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3

0
1 KB

117ms
117ms

Image
text/plain

44.212.199.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3
Protocol: H2
Server: 44.212.199.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-212-199-129.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Dec 2023 19:38:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=90b5f200-0f02-4cab-960c-e3edb2ed37e3
date: Mon, 04 Dec 2023 19:38:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 204 pbsync
usermatch.targeting.unrulymedia.com/ Frame 42F7 0
0 56ms
44ms Document
text/plain 46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697922&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://bidder.newspassid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Mon, 04 Dec 2023 19:38:22 GMT

GET
H2 200 cookie
cm.adform.net/ Frame 27B1 43 B
106 B 135ms
40ms Image
image/gif 37.157.5.133

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.133 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:38:22 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2 204 pbsync
usermatch.targeting.unrulymedia.com/ Frame 1B97 0
0 44ms
44ms Document
text/plain 46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=9971a8fe-eccc-4da7-b28f-eb5e2d8951e4&publisherId=NPID10000001&siteId=3500000313&cb=1701718697914&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://bidder.newspassid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Mon, 04 Dec 2023 19:38:22 GMT

Verdicts & Comments Add Verdict or Comment

381 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

62 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.liadm.com/j	1970-01-21 02:17:58	Name: lidid Value: b4400199-ae79-4218-bdd9-9e7b7894d8bb
i.liadm.com/s	1970-01-20 17:25:10	Name: _li_ss Value: ChMKBgjdARDTFgoJCP____8HEN0W
i6.liadm.com/s	1970-01-20 17:25:10	Name: _li_ss Value: CgA
heraldcourier.com/	1970-01-20 17:25:10	Name: _pbjs_userid_consent_data Value: 3524755945110770
.heraldcourier.com/	1970-01-21 01:27:34	Name: _pubcid Value: 9971a8fe-eccc-4da7-b28f-eb5e2d8951e4
.simpli.fi/	1970-01-21 01:29:01	Name: suid Value: 12431DACDBCF44CC90BB57EE850E30D8
.heraldcourier.com/	1970-01-20 16:42:00	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://heraldcourier.com/%22%2C%22sref%22:%22%22%2C%22sts%22:1701718697229%2C%22slts%22:0}
.heraldcourier.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .heraldcourier.com
.heraldcourier.com/	1970-01-21 02:17:58	Name: _lc2_fpi Value: 3f389ea64a07--01hgv5d98pp9zmmypxrbfb53vd
.heraldcourier.com/	1970-01-21 02:17:58	Name: _lc2_fpi_meta Value: {%22w%22:1701718697238}
.heraldcourier.com/	1970-01-21 02:11:22	Name: _parsely_visitor Value: {%22id%22:%22pid=40510332-4f85-44a7-bc0d-23309b748fa9%22%2C%22session_count%22:1%2C%22last_session_ts%22:1701718697229}
.heraldcourier.com/	1970-01-21 02:17:58	Name: _ga_4T2EB147B8 Value: GS1.1.1701718697.1.0.1701718697.60.0.0
.heraldcourier.com/	1970-01-21 02:17:58	Name: _ml_id Value: fbad9b5544588046.1701718697.1.1701718697.1701718697
.heraldcourier.com/	1970-01-20 16:42:00	Name: _ml_ses Value: *
.criteo.com/	1970-01-21 02:03:34	Name: uid Value: 850c8404-dacf-49e3-b574-4f5ded00e2db
.criteo.com/	1970-01-21 02:03:34	Name: receive-cookie-deprecation Value: 1
.heraldcourier.com/	1970-01-21 02:03:34	Name: __gads Value: ID=3e5983c88c2ed662:T=1701718697:RT=1701718697:S=ALNI_MaD-jUaOh8Lpy9WAI2NBSx11B_Tjg
.heraldcourier.com/	1970-01-21 02:03:34	Name: __gpi Value: UID=00000d035bf0b3e0:T=1701718697:RT=1701718697:S=ALNI_MYZBkO5db0eZnAqaBYCYYLO9dDtIQ
.heraldcourier.com/	1970-01-20 18:51:34	Name: _fbp Value: fb.1.1701718697598.1003407637
.openx.net/	1970-01-21 01:27:34	Name: i Value: 0779f85f-1232-4c5e-a1e3-65bf7e9a117a\|1701718697
.heraldcourier.com/	1970-01-20 16:42:02	Name: AMP_TOKEN Value: %24NOT_FOUND
.heraldcourier.com/	1970-01-21 02:17:58	Name: _ga Value: GA1.2.539967043.1701718697
.heraldcourier.com/	1970-01-20 16:43:25	Name: _gid Value: GA1.2.492448081.1701718698
.heraldcourier.com/	1970-01-20 16:41:58	Name: _dc_gtm_UA-54716522-7 Value: 1
.heraldcourier.com/	1970-01-20 16:41:58	Name: _dc_gtm_UA-54716522-2 Value: 1
.heraldcourier.com/	1970-01-21 02:03:34	Name: cto_bundle Value: to1wz19Mc2JJQVp4WWhURWExcmh4NUpjOUslMkIwMlJKRFBraCUyQnp4UHpPOUJhTU81cyUyQiUyQkx1NHF2MnZDYjVPQnk0UEhYbmM0OFV5eU9qN0x4Y3E1YVRnQUVEMElPdTVQUDZoZ2Y0eEU1dnpxUHJBeCUyQm9RYU55bzEwdkoyZWNoVFJqQkJCeFhPOE8lMkZnJTJCcTRLYTFMYW5GbDF3R1k2cm94QUszbW5SQzlCYSUyRjNFMHV2OG9BJTNE
.heraldcourier.com/	1970-01-21 01:27:34	Name: ajs_anonymous_id Value: 262ef571-8ca8-4470-a6e8-9f9b4c35b847
.heraldcourier.com/	1970-01-21 01:27:34	Name: connectId Value: {"ttl":86400000,"lastUsed":1701718697712,"lastSynced":1701718697712}
.doubleclick.net/	1970-01-21 02:03:34	Name: IDE Value: AHWqTUkKpIs9VH5WWSYA-mY0OLJjhtp0Q0kV8So23-tszBvSCJt9rEJFnz_aVty3yug
.liadm.com/	1970-01-21 02:17:58	Name: lidid Value: b4400199-ae79-4218-bdd9-9e7b7894d8bb
.postrelease.com/	1970-01-21 01:27:34	Name: opt_out Value: 1
heraldcourier.com/	1969-12-31 23:59:59	Name: ntvSession Value: {"id":188519,"placementID":1173341,"lastInteraction":1701718698193,"sessionStart":1701718698193,"sessionEndDate":1701730800000,"experiment":""}
.heraldcourier.com/	1970-01-21 02:17:58	Name: _ga_S5LKEZJN96 Value: GS1.1.1701718697.1.0.1701718698.59.0.0
.heraldcourier.com/	1970-01-20 17:25:10	Name: _li_ss Value: ChMKBgjdARDTFgoJCP____8HEN0W
.heraldcourier.com/	1970-01-20 17:25:10	Name: _li_ss_meta Value: {%22w%22:1701718698969%2C%22e%22:1704310698969}
.simpli.fi/	1970-01-20 16:52:03	Name: uid_syncd_secure Value: true
.1rx.io/	1970-01-21 01:27:34	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003%22%7D
.agkn.com/	1970-01-21 01:27:34	Name: ab Value: 0001%3ABzoX7gVji6F2TQhcf6lSHefOABAbXqrf
.tapad.com/	1970-01-20 18:08:22	Name: TapAd_TS Value: 1701718699812
.tapad.com/	1970-01-20 18:08:22	Name: TapAd_DID Value: 19ed1c56-4aa0-43b4-84e2-e583c850459f
.adnxs.com/	1970-01-20 18:51:34	Name: uuid2 Value: 4950480544048662813
.tapad.com/	1970-01-20 18:08:22	Name: TapAd_3WAY_SYNCS Value:
.pro-market.net/	1970-01-20 17:25:10	Name: anHistory Value: "pqjj93s55ago+2+!#7%.%k#bYa"
.exelator.com/	1970-01-20 19:34:46	Name: EE Value: "e3d4a8da1160efe6b662dc4520331166"
.adnxs.com/	1970-01-20 18:51:34	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2E>>jb5Kk!]tbPl1N!7OnM$=BWzwe:[KYiJqPal!1MVl#Jkmfn[(kjcdSicy'+UeFrz-jOcH/X%W#.wL4W1Qw25c*p$Y
.exelator.com/	1970-01-20 19:34:46	Name: ud Value: "eJxrXxzq6XKLQSHVOMUk0SIl0dDQzCA1LdUsyczMKCXZxNTIwNgYKGa2uCy1aMHS0uLUlKRDSypySnKaVpfFhzrGuzn6evpELnPOKMrPTV0BFgpzDVpsaGi5JL8oM32Ri%252BviopQ0hkUlxaeCj0lrAwCWaClm"
.pro-market.net/	1970-01-20 21:01:10	Name: anProfile Value: "pqjj93s55ago+1+1f=1+1g=1+1j=41+rs=s+rt=2A0104A0133800920000000000000007+s2=(s55qjv)+vm=24-12431DACDBCF44CC90BB57EE850E30D8:53-CAESEJHuv95ThkPOj-upDNuUwDI"
.targeting.unrulymedia.com/	1970-01-21 01:27:34	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-e3b46c9a-6029-4d55-affa-e1e58d9135a8-003%22%7D
.agkn.com/	1970-01-21 01:27:34	Name: u Value: C\|0AAAAAAAALQDnLAAAAAAA
.bluekai.com/	1970-01-20 21:05:29	Name: bku Value: blx99vL3qZU2F26X
.bluekai.com/	1970-01-20 21:05:29	Name: bkpa Value: KJy9nyexd02pSUHknp/8mE1hwtkAwEW0Be1hHWaeHWJeHMx6x6181WJYBE5aHEQN1WDp1WxT9y93bQFJ
.bfmio.com/	1970-01-21 01:27:34	Name: __141_cid Value: 12431DACDBCF44CC90BB57EE850E30D8
.bfmio.com/	1970-01-21 01:27:34	Name: __io_cid Value: 924ac7fd7faf3f6f5ec62526f4c4d9604c5b41dc
.bidder.newspassid.com/	1970-01-20 18:51:34	Name: newspassid_uid Value: 2Z5jBnlmd9jcWse4b8cuCwWWBEz
bidder.newspassid.com/	1970-01-20 18:51:34	Name: newspassid_uid Value: 2Z5jBnlmd9jcWse4b8cuCwWWBEz
.3lift.com/	1970-01-20 18:51:34	Name: tluid Value: 973184888815073815432
.bidswitch.net/	1970-01-21 01:27:34	Name: tuuid Value: 90b5f200-0f02-4cab-960c-e3edb2ed37e3
.bidswitch.net/	1970-01-21 01:27:34	Name: c Value: 1701718701
.bidswitch.net/	1970-01-21 01:27:34	Name: tuuid_lu Value: 1701718701
.ads.pubmatic.com/	1970-01-20 16:43:25	Name: KCCH Value: YES
bidder.newspassid.com/	1970-01-20 16:52:03	Name: AWSALBTGCORS Value: pLt2To+6UaU80OHDc/PWz4PXPy4Y4Zoxl8QFfcSKwpujvSEm6vEy6ILVFLjQGEjCmKGdng+0sqX9/IM6OXOiEJpAK4iHt2uC4DQ4uhmvvy9jicilWZhk5yOFJ4pq7cj5RIXaYXK0o796WGPuQRG/pgXPfs0oZnp6ycMxW2VE9OswbFY76OE=
.bidder.newspassid.com/	1970-01-20 18:51:34	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJhZG54cyI6eyJ1aWQiOiI0OTUwNDgwNTQ0MDQ4NjYyODEzIiwiZXhwaXJlcyI6IjIwMjMtMTItMThUMTk6Mzg6MjIuMTQwODM0OTY0WiJ9LCJncmlkIjp7InVpZCI6IjkwYjVmMjAwLTBmMDItNGNhYi05NjBjLWUzZWRiMmVkMzdlMyIsImV4cGlyZXMiOiIyMDIzLTEyLTE4VDE5OjM4OjIxLjk1NTE1NjkwNloifSwib3BlbngiOnsidWlkIjoiZWQwYjQ4YzktMDIyYS00MDQwLTkwYjktNmQ0MjliZTZlMDBhIiwiZXhwaXJlcyI6IjIwMjMtMTItMThUMTk6Mzg6MjEuNDM1OTI3MDc4WiJ9LCJ0cmlwbGVsaWZ0Ijp7InVpZCI6Ijk3MzE4NDg4ODgxNTA3MzgxNTQzMiIsImV4cGlyZXMiOiIyMDIzLTEyLTE4VDE5OjM4OjIxLjYzNjcyNjA2OVoifX0sImJkYXkiOiIyMDIzLTEyLTA0VDE5OjM4OjIxLjQzNTkyMjY3N1oifQ==

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=12431DACDBCF44CC90BB57EE850E30D8 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=12431DACDBCF44CC90BB57EE850E30D8 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://idsync.rlcdn.com/419566.gif?partner_uid=12431DACDBCF44CC90BB57EE850E30D8 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ad.gt
aa.agkn.com
aax.amazon-adsystem.com
ad2.360yield.com
ads.pubmatic.com
ampcid.google.com
ampcid.google.de
ap.lijit.com
api.segment.io
b-code.liadm.com
bcp.crwdcntrl.net
bidder.newspassid.com
bloximages.chicago2.vip.townnews.com
bloximages.newyork1.vip.townnews.com
c.amazon-adsystem.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.parsely.com
cdn.prod.uidapi.com
cdn.segment.com
cdnjs.cloudflare.com
ce.lijit.com
cm.adform.net
cm.g.doubleclick.net
config.aps.amazon-adsystem.com
connect.facebook.net
connectid.analytics.yahoo.com
d.agkn.com
d1eoo1tco6rr5e.cloudfront.net
dis.criteo.com
eb2.3lift.com
email.alerts.heraldcourier.com
esp.rtbhouse.com
f33519e50547da0b660a5946b26b150a.safeframe.googlesyndication.com
fei.pro-market.net
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
heraldcourier.com
i.liadm.com
i.simpli.fi
i6.liadm.com
ib.adnxs.com
id.hadron.ad.gt
id5-sync.com
idsync.rlcdn.com
image6.pubmatic.com
insight.adsrvr.org
invstatic101.creativecdn.com
jadserve.postrelease.com
js.matheranalytics.com
lb.eu-1-id5-sync.com
loadm.exelator.com
match.sharethrough.com
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
p1.parsely.com
pagead2.googlesyndication.com
pbid.pro-market.net
pixel.rubiconproject.com
pixel.tapad.com
region1.analytics.google.com
rp.liadm.com
rp4.liadm.com
rtb.openx.net
s-jsonp.moatads.com
s.ad.smaato.net
s.ntv.io
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
simplifi.partners.tremorhub.com
sli.heraldcourier.com
stags.bluekai.com
static.criteo.net
stats.g.doubleclick.net
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.targeting.unrulymedia.com
tag.simpli.fi
tagan.adlightning.com
tags.crwdcntrl.net
tpc.googlesyndication.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
usermatch.targeting.unrulymedia.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.i.matheranalytics.com
x.bidswitch.net
z.moatads.com
104.16.133.24
107.178.250.234
13.227.217.72
13.227.222.191
13.248.245.213
141.95.33.120
142.250.184.226
142.250.186.162
162.19.138.116
178.250.1.9
18.198.126.47
18.238.17.128
18.238.243.82
18.239.69.131
18.245.60.10
18.65.39.72
185.89.210.82
192.104.183.209
198.47.127.19
2.19.84.188
2001:4860:4802:32::36
216.52.2.39
216.52.2.48
23.2.235.168
23.43.61.119
23.57.19.78
2600:1901:0:8eee::
2600:1f18:612b:4200:e43e:a85c:2848:83d
2600:1f18:730:b150:8a29:493b:1f46:72ba
2600:1f18:ed:550e:bb8f:8f68:a616:96a6
2600:9000:2090:200:10:dd8:5e40:93a1
2600:9000:225e:a200:8:8845:1500:93a1
2600:9000:2447:9200:a:e047:753:a221
2600:9000:25e8:1200:1b:5138:8a40:93a1
2600:9000:25e8:6e00:d:e169:8180:93a1
2606:4700:10::6816:3456
2606:4700:10::6816:445
2606:4700:10::6816:545
2606:4700:10::ac43:246e
2606:4700::6810:5914
2606:4700::6811:190e
2a00:1450:4001:800::200e
2a00:1450:4001:802::2004
2a00:1450:4001:803::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:810::2002
2a00:1450:4001:81c::2001
2a00:1450:4001:828::200e
2a00:1450:4001:829::2002
2a00:1450:4001:829::2008
2a00:1450:4001:829::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2003
2a00:1450:400c:c00::9b
2a02:2638:3::3
2a02:2638:3::c
2a02:26f0:2c::216:f221
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
3.65.68.8
3.68.0.8
3.75.62.37
34.102.146.192
34.111.113.62
34.120.107.143
34.206.108.117
34.96.70.87
34.98.64.218
35.155.246.37
35.156.210.91
35.190.39.111
35.204.74.118
35.204.89.238
35.227.252.103
35.244.174.68
35.71.131.137
37.157.5.133
44.212.199.129
46.228.174.117
50.17.66.232
52.17.99.225
52.18.121.48
52.213.214.202
52.44.250.119
52.57.111.197
52.84.179.168
54.198.156.105
54.216.8.15
65.9.66.122
69.173.144.165
72.246.169.24
0122e9f2e59f9251d6f7b9bbdb74262a097e0d753d50347fa4d5559b883c49a3
02ff16debc594a21ed69f9c4233032b8fdbcbd79b26f41a6bc20d0231ca2d12d
0341c74d9a288f6cbf8ee66ad46c9605aba53b4d13ba62fa89c2462f8a71a783
0380bf582f2be39c9be28052559c68648e973fa35a3e38cab5a9e1d0bd3aed58
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
076f281a9257ad662f34badb12393195fdca0dc2fde9acd1f1628b9674a96aee
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
101184683ffdeec2ca9f83c6f7416fceec9b7b7e9cda1957125aef24dd4179d8
1186699d4cc78d7acd98f87883b1434fa96f46c29aafba60659b1f97814fd3d7
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
14f0cc1996dedbe97005c628c6ef5755e756f047cd1f154e981138e19a3591a9
1a77010a20c4a6611c4230df5afe003914255a35909daabaaa5a8f0427c73eec
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
1c0d0e892ad6fb18074eda0d880790b80bb26768fa4dcbc8cf9d62fc2da82334
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1dd0886c6750b35c648ebe184de9aee7ef8e45e497e5399957af74cf8628f505
202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2
2199c574519177285f697c62ca66e9d1d90f8b1238dd3d4a7e8d9970e836116d
2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2
296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2e8588fd539779e736404cdd91e516fb1488cbdacc861fadeaf50f4c24b4b943
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3142810ad639796eb4e954508e1287a06b74ee2f3de55b75c871c6be0855857a
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32209e964449881b7f2a21086506deccc49063673c2cfff6288598f843fc81c4
3331a0486cb3e8a75c8c2fdf02bf80fd8fe2b811dfe5c7b4aa892d38bfcf604a
3386bb5a79ff2284d6557313c0ddd06b0a64b9bfb6daf9631aaf6d2343d219cd
355c9a5fb4e0a4ff29c1472881fd6ee3003933d44792252a5cd5985675de862a
35e78a5db949143ceca3d1a4c833e957ec2ffa8728c7c4b9f12d3ce1f8206e87
3c01c1e199879f8b72679cc4d402684ba9e88c21b633547adbae6ba03a617fdc
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e6900c17cbc365c6535dbcae8530f85958776a43efa80fab83aeb23d502bb97
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f7d4fce911e0a58ed4224b9f65d90a98d8bb7b76d25ad2610485b9baaa1d447
4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4563823fd629a48517c7feb8bf33640e12440e08bdde7a172ce477c2ddfc9c4d
45782508a28c1f03ebbfd53a3f172c85e77877a18b612b6dd23819cdc35dc54f
459c4809edef91bbb44e8cd0bb4758c885b557521852976d87e6781e10227296
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b9d00cdddea53b43ce092a8545d5527689379561d18d6f925355562ab2f359e
4c0867ff49805574426a7a89e712807767fa9b2452c526736947e2b897a080ad
4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f
4dc723b7dd6602e39eb50fa74c7df276cb468805f5fae7450b00b8a568973a09
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
53046268ca94dd29b29f2595bbe6a5ab8356f0e03956f4276f954979cdedfe94
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
559fdcdead17645fda4bc010b73aaab06dd70a7974e6ec58bbf3168ac364a387
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57f295553fdda2a7f1ee0e5dab92d82f2bace1df0a781117dee1cb06eacbf891
597daf379001f8d7417edfd336da0b3cbf17e3125a0bf8749e0bb9606e2e17fd
5cb9ec628a3a88428ab0dd29413e716c930932b4175133aaaf33a9a69d6332da
613ee3275e0499c65cc5acae15b799975d0733505af7e15a05ba3f70443a6ea1
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57
658ba9017b2658528da4226e25355a51ae64431917521b4181afa81e9a7ca3ba
68dacdafab7ea3a286824d19f8ce35cdc568f99971c2d261e1be5a72ad3ea8ca
69316bde85428108020829bb1b79e145922a983b6f5ba55c74c82f6f46de9938
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b96eb73da5fe3c20e4507bf752917f6d7978be8881c1dea934db282b028407d
72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc
7310e401efd5214d7c4baf2a6df94becd6d945da0682fbc3a93274eadc68e8c2
7571db16348512fc55b35102ce3699733cf0882f4b4fb3e652fa8db700c07fb5
76460f1cd530a92dcb3d35468233b10d40dcb0ea7595aceb225104e63c3b78bc
7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59
77b109dd53ec2921d47af5eedcf39cbea8bc92bf8b59a970aa104c5ed2d5b3c0
7976a9dfe57f9ba6972420500782258da674fcc523c2def08bb6a84ce275c4b5
7b7c242b14d45300e4d7845715a58e317cb5b8df24b2593679d96fc48c36cb7b
7ceea651620891f4e4b4cce92f90c696e3da60c1b755d93adff13f0d2a5ff4d8
7e4fde2a7e2da4eb11065a29f03b7f68566665515cf79bf4841168b46508dda5
7e9cb3d5b8b7ca713c80a27af91c2a4632fdf41bfc609923e9da59b2ece9c77d
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86267a2e736cb47a9f96e983884d1a2333195cb7d1e37ba29eca3765a4e0c06f
86591a2be5e936bf53c1dcf1d099d14742db949caec4da8c39d159447ce74b9b
86660ef44d06ab8ca08059da26d814a85c5429eedd7c5f48c88bfcced3525fd8
8ab9512cb3b702e2e31ac2a18526bc99d80d492b4cdc7820700832faeedb4426
8c4ac46a4c97af74d832fdeb350960947ba7b246e01731ab6864f4ef17fb7931
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09
8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652
8e683a0ae8fc37aeae8fd20643faef0341fe5cf01c30f25f41d6bad28b1a8365
8e69c64655718315422d63e22bc7dddaacd2fe1e1ceb20a6758287a76b9c6f66
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235
9453c81287d37b52d6364987b4fe7618de7f9761f3d6805432132efa7d5d2c60
953af41def7be73c21fba2b47e04ede6dbfe0953f42b9f4c3cf310455b7fabb6
95e8b69ceb5dabfbd69c8bbdca03c9085c5496da61a4f75cc953bbb6e9c16f00
96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48
98e6908a5e89a28d5a21b6a55aea42d340de41ac5e66083f1098d897c09cc792
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
999b83d9c05b96d1b048e5cbf8003d781e9c52f1e16fd39817df95ca2e1cbfa1
9fcc71a59795a98106a3bab9737c0fce5d07d5080ce2e0832adf5f95b30f572f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9
a2abf60298591077c6d5b81d97380295dd942ef36095adf4de1ee06f90077545
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a79e2fb728c4d8d99bf24ddfe2c10ee101d2b20762b2d4060ca9a5506962fd55
aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9
ab37f0162374a31204d5f9b472406caf196aee2f662f8ec741bc063bbd22ca20
adfa39b53589a91e67b4d82766750bee32371b51438f41dfbd6da0764719370e
b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154
b10a075758097bb0578287af03c76a9fcd82fa4607587109ae41fe2d24756600
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3f0881ce943117ed30a4e82a66d3773b70d9a908203a57de0c011566b4c4e6c
b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83
b93740066fadbde00a03ff560765bd25b8e9ca74f7774a4633f61ce44b332991
b98b5c6e0b77598589ebf0b7ea7489b18f16a71d7a2d81b85006948d1bf3d95e
bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bf8a676a7f02c526c2946d58540257c34ef4a32ccd46787e08a031073b4ff642
c2008966819bb51e24bb6cbf82ef28efeb4d678e20c3b61fc02bb5d45b45e74e
c417bdd5756646f7102a004458c6aa90e7a4c7ff04631494f0a9b8099619343d
c4212eef2876eb083a172b80c748943d9bc27361dfbc8268aa6ee786eee71c5b
c56eaad58c865a0499996bfbe56d4fed19e68a1a2ef1b82bc64c95941e3754af
c5c357a5e69089e5088279fc5aaa5663d088815b3408a005dd6bc93b50bf7745
c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a
c996d21298b0a0185fee6ad94f426102f02015ea6d9ab1420b9fc09bd7f627bf
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca996a497846f96d7007ff38ac5c8db1c53f79ee08c682b439919812247f5148
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cab29d30666c18a6b431d25c7d278a299bdb3d7b87c81400a813beb3b5d286e4
cbe9c0c9b4943f2b33d7f9a4294b07c1908172de4553e487c19439e5d3b410ce
ceee61a75f092110af27669da11aa1add96421879822930805a3b2e42c1ebdae
cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d
d0cd2abb3d54b938e438d71bf16f25757511f1238b4195e8ad1ea918f0d3b57a
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d3770c645efabf8bb50f83cdac4a1d42cb39d17ec4068779749c2538c47919e9
d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d7824083749ab73e8e4bd875866cacf3db5420dfdaa923e1e4db753a86fb6686
d9456f051085b88b56a9b3d3f1b180eded38e4e51c8d76961e67a11b8dbb9f59
dae66852e0a17c8a1bb1050b6e3c4f2c10e3aff0d390a59f4ae26a481ca53a9b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddd1991e3d8ce67431989f8cca95743706d110f064ed2b3609041a3f20e50d2c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e19b91215830eb7f731ccd0eeed7170a6f9a1d5147003237152ac47f41ac23b3
e208efd3bc7196c5db30d0bf795cfb8513849fded1049006dce387cb818ebfc9
e25c053415444bcb4037958dbc0267384ba680d874e6a27675e0591f3949f738
e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e855db7e85c20e23c01cfea41de3cb4667a9098f8acf96c0d92c56d8e0055da5
e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2
e88bc41dfc3e11b318a5a3eeeb403b70f98705db64962f4647a3ad2cb9083aa6
eb1109a3ec1d9f4415476dada2b0bd9bfe750fc0bb29a79869fc35cf8edfe1d8
ebaeac0c7976dbc942d5c49cc63b696b88c5ff8720a3ba86a4a6c156ccf1e32a
ed2834cdb21e88ae8b49e6be53114befff5403d859f52788f3634f0f1dc4fa11
ee2f5f86f89a5b0ea70fd58bfd838f8db82febe419d51e98e1c9e8f8a4df8046
eec1d339b9dac9ef9991e418a6fd71c2cf953d77ed1597ed68f82fcc12bf7767
eec3ef03fa30c8d0f116312a4b883d0becd32e3bf8d114ed70b0bae41d9e0380
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5e55a21dfa3a20ceb298737c8f4c517a83d7960468c7f53b3f33c567bacff3c
f65079c7844584bf156ebb99949a883280f65cc817eab327c170d766c2a4fa5f
f98e8196d88bff2a006872a05d79c2d695f6dda36e0aecdd0ace020207809f40
fd2c680964b28dc283f3518e21720cd2f886e7bdb8d2f5b47809ef836c337d52

heraldcourier.com Open in urlscan Pro 192.104.183.209 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

234 Requests

86 %HTTPS

38 %IPv6

64 Domains

100 Subdomains

83 IPs

8 Countries

3116 kBTransfer

8828 kBSize

62 Cookies

12 Outgoing links

Page URL History

Redirected requests

234 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

heraldcourier.com Open in urlscan Pro
192.104.183.209 Public Scan

Screenshot
Live screenshot

Full Image

234
Requests

86 %
HTTPS

38 %
IPv6

64
Domains

100
Subdomains

83
IPs

8
Countries

3116 kB
Transfer

8828 kB
Size

62
Cookies

234 HTTP transactions
4 data transactions