mynewsmedia.co Open in urlscan Pro
104.21.51.98 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gplinks.in/jcizToW
Effective URL:
https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Submission: On October 16 via manual (October 16th 2021, 5:41:48 am UTC) from MX — Scanned from DE

Summary HTTP 65 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 27 IPs in 6 countries across 27 domains to perform 65 HTTP transactions. The main IP is 104.21.51.98, located in and belongs to CLOUDFLARENET, US. The main domain is mynewsmedia.co.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 26th 2020. Valid for: a year.

This is the only time mynewsmedia.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 5	172.66.43.126 172.66.43.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	104.21.2.80 104.21.2.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	104.21.51.98 104.21.51.98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.250.186.136 142.250.186.136	15169 (GOOGLE) (GOOGLE)
2	104.21.90.9 104.21.90.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	178.162.196.156 178.162.196.156	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
1	23.109.248.161 23.109.248.161	7979 (SERVERS-COM) (SERVERS-COM)
1	172.255.6.120 172.255.6.120	7979 (SERVERS-COM) (SERVERS-COM)
1	51.195.31.12 51.195.31.12	16276 (OVH) (OVH)
2	142.250.186.138 142.250.186.138	15169 (GOOGLE) (GOOGLE)
1	104.16.18.94 104.16.18.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.21.53.30 104.21.53.30	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	69.16.175.10 69.16.175.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.16.85.20 104.16.85.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	139.45.197.15 139.45.197.15	9002 (RETN-AS) (RETN-AS)
3	142.250.181.238 142.250.181.238	15169 (GOOGLE) (GOOGLE)
2	142.250.185.227 142.250.185.227	15169 (GOOGLE) (GOOGLE)
1	40.114.177.156 40.114.177.156	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	173.194.76.156 173.194.76.156	15169 (GOOGLE) (GOOGLE)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
1	139.45.197.156 139.45.197.156	9002 (RETN-AS) (RETN-AS)
6	13.225.87.13 13.225.87.13	16509 (AMAZON-02) (AMAZON-02)
2	13.225.87.90 13.225.87.90	16509 (AMAZON-02) (AMAZON-02)
2	104.21.45.207 104.21.45.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.32.23.200 13.32.23.200	16509 (AMAZON-02) (AMAZON-02)
1	104.26.14.238 104.26.14.238	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.218.233.193 52.218.233.193	16509 (AMAZON-02) (AMAZON-02)
65	27

5 172.66.43.126 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gplinks.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.2.80 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gplinks.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.21.51.98 (None, )

ASN13335 (CLOUDFLARENET, US)

mynewsmedia.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.136 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.21.90.9 (None, )

ASN13335 (CLOUDFLARENET, US)

vmuid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.162.196.156 (Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

aptimorph.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.109.248.161 (Netherlands)

ASN7979 (SERVERS-COM, US)

cinglecitrals.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.255.6.120 (Netherlands)

ASN7979 (SERVERS-COM, US)

yookcasula.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.195.31.12 (France)

ASN16276 (OVH, FR)
PTR: ip12.ip-51-195-31.eu

yantrasbarges.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.18.94 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.53.30 (None, )

ASN13335 (CLOUDFLARENET, US)

www.pnglib.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.85.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.197.15 (United Kingdom)

ASN9002 (RETN-AS, GB)

in-page-push.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.181.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.114.177.156 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

api.duckduckgo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.76.156 (United States)

ASN15169 (GOOGLE, US)
PTR: ws-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.156 (United Kingdom)

ASN9002 (RETN-AS, GB)

static.cdnativepush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.225.87.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-13.fra2.r.cloudfront.net

nandlookfo.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.87.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-90.fra2.r.cloudfront.net

ursegreatm.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.21.45.207 (None, )

ASN13335 (CLOUDFLARENET, US)

freychang.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.23.200 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-200.fra56.r.cloudfront.net

d1esebcdm6wx7j.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.14.238 (United States)

ASN13335 (CLOUDFLARENET, US)

stats.vlitag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.218.233.193 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-r-w.amazonaws.com

webpick-cdn.s3.us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	mynewsmedia.co mynewsmedia.co	460 KB
6	nandlookfo.fun nandlookfo.fun	7 KB
5	gplinks.in 1 redirects gplinks.in	28 KB
3	google-analytics.com www.google-analytics.com	20 KB
3	in-page-push.com in-page-push.com	32 KB
3	googletagmanager.com www.googletagmanager.com	114 KB
2	amazonaws.com webpick-cdn.s3.us-west-2.amazonaws.com Failed	19 KB
2	cloudfront.net d1esebcdm6wx7j.cloudfront.net	1 KB
2	freychang.fun freychang.fun	1 KB
2	ursegreatm.fun ursegreatm.fun	734 B
2	gstatic.com fonts.gstatic.com	46 KB
2	googleapis.com fonts.googleapis.com	2 KB
2	vmuid.com vmuid.com	5 KB
1	vlitag.com stats.vlitag.com	557 B
1	cdnativepush.com static.cdnativepush.com	1 KB
1	rtmark.net my.rtmark.net	543 B
1	doubleclick.net stats.g.doubleclick.net	459 B
1	duckduckgo.com api.duckduckgo.com	3 KB
1	jsdelivr.net cdn.jsdelivr.net	4 KB
1	jquery.com code.jquery.com	30 KB
1	pnglib.com www.pnglib.com	22 KB
1	cloudflare.com cdnjs.cloudflare.com	6 KB
1	yantrasbarges.com yantrasbarges.com
1	yookcasula.com yookcasula.com	1 KB
1	cinglecitrals.com cinglecitrals.com	1 KB
1	aptimorph.com aptimorph.com	39 KB
1	gplinks.co 1 redirects gplinks.co	1 KB
65	27

	Domain	Requested by
17	mynewsmedia.co	mynewsmedia.co
6	nandlookfo.fun	mynewsmedia.co
5	gplinks.in	1 redirects mynewsmedia.co
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	in-page-push.com	mynewsmedia.co in-page-push.com
3	www.googletagmanager.com	mynewsmedia.co www.googletagmanager.com
2	webpick-cdn.s3.us-west-2.amazonaws.com	mynewsmedia.co
2	d1esebcdm6wx7j.cloudfront.net	nandlookfo.fun
2	freychang.fun	mynewsmedia.co
2	ursegreatm.fun	mynewsmedia.co
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	mynewsmedia.co
2	vmuid.com	mynewsmedia.co vmuid.com
1	stats.vlitag.com
1	static.cdnativepush.com	mynewsmedia.co
1	my.rtmark.net	in-page-push.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	api.duckduckgo.com	mynewsmedia.co
1	cdn.jsdelivr.net	mynewsmedia.co
1	code.jquery.com	mynewsmedia.co
1	www.pnglib.com	mynewsmedia.co
1	cdnjs.cloudflare.com	mynewsmedia.co
1	yantrasbarges.com	mynewsmedia.co
1	yookcasula.com	mynewsmedia.co
1	cinglecitrals.com	mynewsmedia.co
1	aptimorph.com	mynewsmedia.co
1	gplinks.co	1 redirects
65	27

This site contains links to these domains. Also see Links.

Domain
p343199.clksite.com
xdowl0adxd0wnloadx.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-12-26` - `2021-12-25`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
aptimorph.com R3	`2021-09-27` - `2021-12-26`	3 months	crt.sh
cinglecitrals.com R3	`2021-10-12` - `2022-01-10`	3 months	crt.sh
yookcasula.com R3	`2021-08-31` - `2021-11-29`	3 months	crt.sh
yantrasbarges.com R3	`2021-08-28` - `2021-11-26`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
in-page-push.com R3	`2021-09-18` - `2021-12-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.duckduckgo.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-02` - `2022-11-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.rtmark.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-27` - `2021-11-26`	a year	crt.sh
cdnativepush.com R3	`2021-10-02` - `2021-12-31`	3 months	crt.sh
nandlookfo.fun Amazon	`2021-02-22` - `2022-03-23`	a year	crt.sh
ursegreatm.fun Amazon	`2021-09-22` - `2022-10-20`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.s3-us-west-2.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-06-23` - `2022-07-24`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Frame ID: EDEE138B18994DECBDBBF1A7661EE56E
Requests: 44 HTTP requests in this frame

Frame: https://mynewsmedia.co//edu/Linkpage/nyc.php
Frame ID: 5780B62E109C9DE782DA52FBC2D97844
Requests: 7 HTTP requests in this frame

Frame: https://mynewsmedia.co//edu/Linkpage/nyc.php
Frame ID: 3265064EEF077E1C0F4C789128771CB2
Requests: 7 HTTP requests in this frame

Frame: https://nandlookfo.fun/MEprSG1RKAglUlF3CW4YQiZWbV92b1kOCQEvGC0PUy4GfhpIfQFmDlwlHiwLQiUFPENeLx9tX3Y9OBwrdikFHRxoIxgdPlp7MgE4CQcOPz8AGwAwG2cwMiwqSiEmAgZpITsdDkcJEXw3ciAtBDxzei8RGmkaJxkVARwpIwJoMyEYOEkyDQIGCQ8JeSxYDy4gVHYwLgsqWQMmBS9HGCcODkMCKQkZdjAqHD5zGA4YFUMQIR4vVxsvBlV4eT0QPwMhMQUFQygnHllJCz0KWnEZGA84eDkpLCh6KA4aPwIHLQpacR4iKioDci0RKHV5CQkjAQkABlR3DUYKLGIZAwojYn46GAFhJCwaGgkMIytdYQIEDwwADC8qLH57PCBZWBg4LwhlAh8xNHUILQI7Vz8teS8HCzgBNXYjIS0Pdi4jLTt5PioKAlscLAosfXkqCwwAAAkuPGIzOR4ZFXgtCQByCzkcHWEDEwUleQg5eyN1CF0KAEQIOnpUdS8qbgdDJQU4UFN+OjwbRTMgGFpEc14sXw
Frame ID: C6A927F590436ED0B8D6799AB468B53A
Requests: 2 HTTP requests in this frame

Frame: https://nandlookfo.fun/TjhVdTUvWjYYCi8FN1NAPFRoUAcIHWczUX9dJhBXLVw4Q0I2Dz9bViJXIBFTPFc7ARsgXSFQBwhQDxt/Pm45GnMGaTYCbxxxNzFiOlIDMFEXYmcFdAl6OkB7DGIFN2QPDxAwRSthFk1nHAk6A3kpXBAhTAdfFB4MFFsRLH0GeWAHUw91NjZYOkoEN3gAdhIRZhh6ZRh7HwkFPXEpHWc3dDZpFDpxdnsDN0J9YiIGUQtCbUd2JnYYL3c2bA0zWTRZEy9UBlJtRXQmCDA/bXdtBBJWJ15kJ3YZfw9FYyJcNDN9d20EHQFrChM7cwx/ATJgF2llN28CVS0mYn4VLR5UKVsWMmEhHWczcBxbGSVhA2sDREYfWmQjcxwKAwZkfnoPE18LdxcSZHheZCRNGn8HBHYmSxY4BndtBBIBNHcERVEfcBsaYyZ9Fz9xG3QTRU0lcBNMdxwKD0VgJVwwLG0caQQgTSVZPSBhCkI2GnF/XDcwcnduByBRIloQNH0YeXMfRiFWJUhZGFkjTQJ4TSJABjdMNEM
Frame ID: 4DFF0929E33C499B1395A762FF3D2D50
Requests: 2 HTTP requests in this frame

Frame: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg
Frame ID: C3E9803555A117BBA98917DEF05D35B4
Requests: 1 HTTP requests in this frame

Frame: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg
Frame ID: 1D2BDA9A05EE74FBB43EEB909C51DC8D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Free Hacking Webinar

Page URL History Show full URLs

https://gplinks.in/jcizToW HTTP 301
https://gplinks.co/jcizToW HTTP 302
https://mynewsmedia.co/edu/?postid=jcizToW Page URL
https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

65
Requests

97 %
HTTPS

0 %
IPv6

27
Domains

27
Subdomains

27
IPs

6
Countries

844 kB
Transfer

1724 kB
Size

17
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://p343199.clksite.com/adServe/banners?tid=GPMOJO_DL_NEW&action=r

Search URL Search Domain Scan URL

URL: https://xdowl0adxd0wnloadx.com/YWrzm442f2d0c25038d497281aa53b908fee3b8ff7c7a?q=Free%20Hacking%20Webinar

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gplinks.in/jcizToW HTTP 301
https://gplinks.co/jcizToW HTTP 302
https://mynewsmedia.co/edu/?postid=jcizToW Page URL
https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://gplinks.in/jcizToW HTTP 301
https://gplinks.co/jcizToW HTTP 302
https://mynewsmedia.co/edu/?postid=jcizToW

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
mynewsmedia.co/edu/
Redirect Chain

https://gplinks.in/jcizToW
https://gplinks.co/jcizToW
https://mynewsmedia.co/edu/?postid=jcizToW

764 B
987 B

324ms
297ms

Document
text/html

104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/?postid=jcizToW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1a97123f6b810df7e528b6c8ad702d31f47e1afbfc73ba1dd05842e4c79de41

Request headers

:method: GET
:authority: mynewsmedia.co
:scheme: https
:path: /edu/?postid=jcizToW
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-type: text/html; charset=UTF-8
link: <https://mynewsmedia.co/edu/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: miss
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2FyqXlwxRONLbsa04RvbLYl0ozp1cD8AwGlUK99koJyMebuL3iXKDjsT7%2FkQtmzO1ZzyiFyfg09qKkVblI%2BckxgFdt0QVscDwYZrd4emuln0WX5dLIlQueloMW5Z%2F1Od9g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 69eef5aeeb9e1f2d-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date: Sat, 16 Oct 2021 05:41:42 GMT
content-type: text/html; charset=UTF-8
set-cookie: AppSession=b72b01856a8a04775395702a119f61a5; path=/; HttpOnly; secure csrfToken=e0d1404e5cd012e98f9d3250810355b25fcbe89c5c2ab3df9cc8277009ca13b8e9ff0ddcf2ca52b50e17067e821260131126ce613e4c8443f1c8c33b624443ac; path=/; HttpOnly; secure app_visitor=Q2FrZQ%3D%3D.NDRiNWU2OGZlZjlkMzMxNTM5OWRhOGY0OTM1YTU0Y2VjMjAxYzM2MmNhN2VkMDlhNWM5MWE1MGVkYWMwYTkwNZU5QuDixZKK5sXyvUfITZ1aU6wbQm%2BRoUAnEQA6rcZU4M%2FhAGUHZkmppqvrFCc%2BfyFG0QRYqULZhsNNjR4yEVWA9KPemYWgz2AIpv7BDFcV; expires=Sun, 17-Oct-2021 05:41:42 GMT; Max-Age=86400; path=/; HttpOnly; secure __cf_bm=6s9eLq6TQXzks5qt1Ikvx5JHzZV.TJhwkOLLW1Q2i6M-1634362902-0-Abjoe3THI8SSwb8t4v1/5+yZIortORF9O9hr47lv4T2FnaYjhWWsh0lLvWti36MHUb9ctECwEfyerbQdysWSmd0=; path=/; expires=Sat, 16-Oct-21 06:11:42 GMT; domain=.gplinks.co; HttpOnly; Secure; SameSite=None
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: https://mynewsmedia.co/edu/?postid=jcizToW
x-frame-options: SAMEORIGIN,SAMEORIGIN
x-robots-tag: noindex, nofollow
vary: Accept-Encoding,User-Agent,User-Agent
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OFVFtqbWKkbyDQef0sAN8wONcxKSJWKBS49d%2FsrUf4n0Ne2xAUQ4%2FXZUiqCdKH34ZSzpMqO1itLJwf%2FnZzWJbNg4AcrzOkBsqyMJUTUBWYDoVZzGttbJ5tXM4z43"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 69eef5adabb84e6d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST
H2 200 Primary Request / Show response
mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/ 23 KB
7 KB 171ms
171ms Document
text/html 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b375a6d026f511bd11f82f63e180620cc6823ce0fc40e7fd7834863ba71b2e0

Request headers

:method: POST
:authority: mynewsmedia.co
:scheme: https
:path: /edu/education-insurance-plans-that-pay-for-higher-education/
content-length: 27
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: null
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-type: text/html; charset=UTF-8
x-pingback: https://mynewsmedia.co/edu/xmlrpc.php
link: <https://mynewsmedia.co/edu/wp-json/>; rel="https://api.w.org/" <https://mynewsmedia.co/edu/wp-json/wp/v2/posts/1568>; rel="alternate"; type="application/json" <https://mynewsmedia.co/edu/?p=1568>; rel=shortlink
x-litespeed-cache-control: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZIxEhkxlopQKXHVx2wpe%2BAW8pVjxOgrSnaoJTzHDJApCArGCfts1V9FhcqeTxgUpjB3xZYeatbHLNOXT2j6aplboqx54VhY0ZhSApm%2F4UUqz9XN6Fvg6TY7dFflJa%2Fl67Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 69eef5b0fcf21f2d-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 42ms
20ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-134987322-6

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0dd68ddab02aee119b41180171e8f053088bfc1eaca0d9811ba2713459e87ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38544
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 16 Oct 2021 05:41:43 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 49ms
27ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-134987322-9

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ac582238012cfcb44f7fcc53e190d365bc5f65e6840bd181d7a9d480e31506ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38552
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 16 Oct 2021 05:41:43 GMT

GET
H2 200 script.js Show response
vmuid.com/ 10 KB
4 KB 95ms
55ms Script
text/javascript 104.21.90.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vmuid.com/script.js?sid=494e7bd8-4622-4312-97f0-3e90f1268f5e
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.90.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d6050216a4bae779bcca48452cb92f7b26a0bae6670496207ed927de8789e48

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NSW9N7C0GGznYQU%2FTxJbxY2%2FXeRRCYkVAiUfah7E1tF9XldFiZGJrmumfuCQtpX9gbPmd7e%2BV2fh%2Fjb12%2FdAlC4r%2BreDXgm8LKvdxDb4U8xHj%2FK%2BL%2BrGzIIIJtY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: no-store, max-age=0
cf-ray: 69eef5b2799d4132-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK sdk.js Show response
aptimorph.com/ 39 KB
39 KB 43ms
13ms Script
text/javascript 178.162.196.156
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: https://aptimorph.com/sdk.js?sid=494e7bd8-4622-4312-97f0-3e90f1268f5e
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.162.196.156 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: nginx/1.14.1 /
Resource Hash: 9134917f6baf04857feef6f3592a48791b656607b65c398f219a0ae567686124

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:43 GMT
Server: nginx/1.14.1
X-Cache-Status: MISS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-store, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 40044

GET
H/1.1 200
OK 36363 Show response
cinglecitrals.com/rfws54hlPKNi/ 5 B
1 KB 84ms
21ms Script
application/javascript 23.109.248.161
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://cinglecitrals.com/rfws54hlPKNi/36363

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

23.109.248.161 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:43 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=1
Server: nginx
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: https://mynewsmedia.co
Access-Control-Max-Age: 600
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
X-Content-Type-Options: nosniff
Keep-Alive: timeout=20

GET
H/1.1 200
OK 29630 Show response
yookcasula.com/1clkn/ 6 B
1 KB 98ms
28ms Script
application/javascript 172.255.6.120
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://yookcasula.com/1clkn/29630

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

172.255.6.120 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

b7848d86edc8dc3b5bc6a5c666069f9a31e000cee51575d3b6083951607e1550

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=1
Keep-Alive: timeout=20

GET
H/1.1 200
OK 31614 Show response
yantrasbarges.com/gLmMHKXZTrStfc/ 0
0 42ms
12ms Script
text/html 51.195.31.12
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://yantrasbarges.com/gLmMHKXZTrStfc/31614
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 51.195.31.12 , France, ASN16276 (OVH, FR),
Reverse DNS: ip12.ip-51-195-31.eu
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://mynewsmedia.co
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS

GET
H2 200 css
fonts.googleapis.com/ 11 KB
817 B 38ms
17ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:300,400,500,600,700,800,900

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f10.1e100.net

Software

ESF /

Resource Hash

4885da660044dd23d5d6aa035466a35f4064cb6b2f73eb762630266b516f3a08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 05:31:24 GMT
server: ESF
date: Sat, 16 Oct 2021 05:41:43 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 16 Oct 2021 05:41:43 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 60ms
24ms Stylesheet
text/css 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2032411
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5631
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2hXAIAazsnYARfyP32zo1beWyUPUabre0HbkpM1VyHkHCeWNsT%2BEuH77ZfSL5LhWE6kjb1rkTYxyxYXUU5H2oPWzaKUW8ETbStwv6skZRmmImH%2FWylHziu9GH3VVzY0lEZXfxRGa"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69eef5b26a78277c-PRG
expires: Thu, 06 Oct 2022 05:41:43 GMT

GET
H3 200 bootstrap.min.css
mynewsmedia.co/edu/Linkpage/assets/vendor/bootstrap/css/ 157 KB
25 KB 17ms
16ms Stylesheet
text/css 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/bootstrap/css/bootstrap.min.css
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Request headers

:path: /edu/Linkpage/assets/vendor/bootstrap/css/bootstrap.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392128
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8JYrYM3Wt%2Bl3LFo3p7VG8GkFpgC7WWQh4UJnk0%2Ft3cA2e2tESKbzYn4UZkKvrczgQyeofhM4y5mk8oPT3rLWTt1KHSUj4HcNRI7gCwo2gJmkZEroqbMYiVWOmQj70ZKLyA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b22f374401-FRA
expires: Mon, 18 Oct 2021 16:46:15 GMT

GET
H3 200 all.min.css
mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/css/ 58 KB
13 KB 25ms
25ms Stylesheet
text/css 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/css/all.min.css
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325

Request headers

:path: /edu/Linkpage/assets/vendor/fontawesome-free/css/all.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392128
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OhuNNApySzeFw71Xw6wT1u%2FeaLQqxnvMh7HcMfiKh%2B2g2a5DOodsFiMPQGyLeQpGN0qyrpQvss8Jdt1bIZeSW2%2FGs5kugZmqk%2BD3Nz%2FVfvJ8l5SLuqjcORp0AY85M%2BoffA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b22f3a4401-FRA
expires: Mon, 18 Oct 2021 16:46:15 GMT

GET
H3 200 simple-line-icons.css
mynewsmedia.co/edu/Linkpage/assets/vendor/simple-line-icons/css/ 11 KB
3 KB 14ms
13ms Stylesheet
text/css 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/simple-line-icons/css/simple-line-icons.css
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb112d50f744cf58c2ebecb8a5b0d950c7f5a7a37c9842d21e2f678144dd149a

Request headers

:path: /edu/Linkpage/assets/vendor/simple-line-icons/css/simple-line-icons.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392128
cf-polished: origSize=12973
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dj59xNdfhaTsq2SGEX8R4X6iWxgdDsjiAYLBRnGx%2BvJDGVRWFncE4YWv1eSqm6q%2FWmAMZIZTIPzH0NTl55i%2FqZWOMKZk%2BjHGeS7rQpejZD1FgHTLnW1vTo99MuMptdKiPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b22f3b4401-FRA
expires: Mon, 18 Oct 2021 16:46:15 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 37ms
16ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f10.1e100.net

Software

ESF /

Resource Hash

334e714a1c5ebefb28783d1c809dda2a01b916554121e92067a2e41417cd10a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 05:35:39 GMT
server: ESF
date: Sat, 16 Oct 2021 05:41:43 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 16 Oct 2021 05:41:43 GMT

GET
H3 200 landing-page.min.css
mynewsmedia.co/edu/Linkpage/assets/css/ 2 KB
1 KB 12ms
12ms Stylesheet
text/css 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/css/landing-page.min.css
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5f0b6e68dfaab5fdafeee920631895fa6c0e3ec2bfe7689fcc6247f854b772f

Request headers

:path: /edu/Linkpage/assets/css/landing-page.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392128
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zcQv7Bd4p0x2vPSo50%2FVg4h8jsuAIfdTEP1X7vVtbOOOkmouQgT2LHcCZ83Q5jejOnndSWLROlvglTQ%2B6FGtUhQLwvl1nweNjCVL8pfMz5suj%2FxipYAqGEhEIZcK8K02LA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b22f3c4401-FRA
expires: Mon, 18 Oct 2021 16:46:15 GMT

GET
H3 200 gp-logo.png
mynewsmedia.co/edu/Linkpage/assets/img/ 7 KB
8 KB 23ms
20ms Image
image/png 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/img/gp-logo.png
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c15ca9bca87b73ee3f65105657ed66ba35b7c7346ad9233fa169af78bd76ae8

Request headers

:path: /edu/Linkpage/assets/img/gp-logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 442126
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7249
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fOPLFf0Paqp%2B17FZbFd563exbSSw3hD1%2BCgz8ujPl24W87y%2FdhlPfb632TcdMA9L9YEXB4vvAQZvdZKWeo25eYra3CP8LZzYS7o4%2F7f7WzeHiZz%2F%2BnVXiIF1eLrRslWHhw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2d8724401-FRA
expires: Mon, 18 Oct 2021 02:52:57 GMT

GET
H3 200 file-download.jpg
mynewsmedia.co/edu/Linkpage/assets/img/ 138 KB
139 KB 24ms
21ms Image
image/jpeg 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/img/file-download.jpg
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd3bbd3b9f8aaf2fa61ef7646899cda12097f7332fa3302bfbec50c80986fe24

Request headers

:path: /edu/Linkpage/assets/img/file-download.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 442126
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 141539
last-modified: Thu, 03 Jun 2021 13:06:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E0EUIEgVqs3ZVnFdG8cSDKPVJq0Pz4IRA2v9kvexsr0TBhsJkVlaCMHb40DB3MmOmRvAdAPBgTMoAUO%2BfLzy5PxNAm%2BKwnKvg8Wzdb7k7647EuCpxy7UzWUk8UOTHBDqow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2d8754401-FRA
expires: Mon, 18 Oct 2021 02:52:57 GMT

GET
H2 200 rocket-download.png
gplinks.in/advertising/banners/ 5 KB
5 KB 40ms
21ms Image
image/png 172.66.43.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gplinks.in/advertising/banners/rocket-download.png

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.43.126 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2bb50caad0d651b2c4bbaca7d9335c99cf51b5580160bdbf3dbf6d3293e761f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 80695
vary: User-Agent,User-Agent, Accept-Encoding
content-length: 5089
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Apr 2020 05:59:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Prpj4HUV4xenVnhZTztcKVDR737yZUZBqUsOgJBtypajtOUpF8slJ5T5eG3X%2Bzpb4uejhnZOgNZ8%2FeF2RdnICWMvDfvc6f7ykbyNWIsJU9H05embaWtvooCeG%2FcX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2fae5278c-PRG
expires: Sat, 15 Oct 2022 07:16:48 GMT

GET
H2 200 files-icon_6021cfc28b193.png
www.pnglib.com/wp-content/uploads/2021/02/ 21 KB
22 KB 42ms
15ms Image
image/png 104.21.53.30
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.pnglib.com/wp-content/uploads/2021/02/files-icon_6021cfc28b193.png
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.53.30 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71b337ac7fe7e8df7f9f8da261d03219901aa574e2819c5c726199078187c1a5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4592795
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21929
last-modified: Mon, 08 Feb 2021 23:56:50 GMT
server: cloudflare
etag: "6021cfc2-55a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=35cx05gC1KH5kNY9%2B6NBCcENem2XQibdPsu%2FO09sSpRL9JNGNWJtmPq0IMxEKxjNe5YD3cxa4GzJLuh%2B7Pb%2BqeELS1oK7h2HIpajL1mmDf0znKB2NO88Hde1mH%2FoRyM9gQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000, no-transform
accept-ranges: bytes
cf-ray: 69eef5b2f95e5363-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 s-download.png
gplinks.in/advertising/banners/ 3 KB
3 KB 41ms
22ms Image
image/png 172.66.43.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gplinks.in/advertising/banners/s-download.png

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.43.126 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33ad047d25a7047fe47f4de1a71f496e5543f07bc2fb2fd64c45869a47b70ba8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 86743
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3232
x-xss-protection: 1; mode=block
last-modified: Sun, 02 Aug 2020 06:23:54 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yfzt1l0e2k7us0g0u9P2yLEzTM4NwCbVLyooUx%2BZiOI8MXy6HJoQVVCZUZcZ4jUgzlsjO8hzwSNm4BwvkhMWpdPxCNk239FM6Nm0O1Gm%2Bc%2BaDQ%2B12e3lFsJxCaqb"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: User-Agent,User-Agent, Accept-Encoding
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2fae3278c-PRG
expires: Sat, 15 Oct 2022 05:36:00 GMT

GET
H2 200 check-verify.png
gplinks.in/advertising/banners/ 5 KB
5 KB 43ms
24ms Image
image/png 172.66.43.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gplinks.in/advertising/banners/check-verify.png

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.43.126 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bd289bc3518e2e20ff95271df4eb47c2db37ef7e113dd4be94029be8c8fa22e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 88679
vary: User-Agent,User-Agent, Accept-Encoding
content-length: 5096
x-xss-protection: 1; mode=block
last-modified: Thu, 25 Mar 2021 07:48:32 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Si4m9TeDxu1lmSJUXSvYn7ELHnhzHtnRLsMWyw6uwfC0MHjQahzXKZn6R7zMAy3lGsaVyUpGpu5uK%2FTjinWnJfhhWMos5NFAbl7J1LFuvEVfoobN25M0padHV1nl"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2fae2278c-PRG
expires: Sat, 15 Oct 2022 05:03:44 GMT

GET
H2 200 start-123.png
gplinks.in/advertising/banners/ 13 KB
13 KB 41ms
22ms Image
image/png 172.66.43.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gplinks.in/advertising/banners/start-123.png

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.43.126 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cac796e636db4a5146cf5fec25f59d180c0e6e3ab3135a2734a66cda24ade4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 88745
vary: User-Agent,User-Agent, Accept-Encoding
content-length: 13297
x-xss-protection: 1; mode=block
last-modified: Thu, 25 Mar 2021 08:15:03 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qXvaxFyxzpNot%2BKh%2F6oNNgBsK9Z5GIUWUqfkDxw%2FMZvncd4L44fyNNE8bYcJa11ELl4JP4pBo63%2Bvbhl9mskgd2%2F6D14T5O643finfZA85jBMVB5VmUsb4Phluxt"}],"group":"cf-nel","max_age":604800}
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31536000
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2fadf278c-PRG
expires: Sat, 15 Oct 2022 05:02:38 GMT

GET
H2 200 jquery-3.2.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 29ms
9ms Script
application/javascript 69.16.175.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.min.js
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: hwcdn.net
Software: nginx /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-15283"
vary: Accept-Encoding
x-hw: 1634362903.dop242.fr8.t,1634362903.cds246.fr8.hn,1634362903.cds133.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30125

GET
H3 200 jquery.min.js Show response
mynewsmedia.co/edu/Linkpage/assets/vendor/jquery/ 87 KB
32 KB 20ms
19ms Script
application/javascript 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/jquery/jquery.min.js
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

:path: /edu/Linkpage/assets/vendor/jquery/jquery.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 442126
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJfXl9RzXdWvLxgvtcwuDn4QPDEHNYHuDHZZEJX6zkziWHkL9kVSLXlFpLIxEgCBqx8NhxVL55QwMAHSGqHdutTVXssFwvduHeE5HeAKxF99LFIzke5UW4KDn5mNzYOakQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b2c85b4401-FRA
expires: Mon, 18 Oct 2021 02:52:57 GMT

GET
H3 200 bootstrap.bundle.min.js Show response
mynewsmedia.co/edu/Linkpage/assets/vendor/bootstrap/js/ 82 KB
23 KB 23ms
22ms Script
application/javascript 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/bootstrap/js/bootstrap.bundle.min.js
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01

Request headers

:path: /edu/Linkpage/assets/vendor/bootstrap/js/bootstrap.bundle.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392128
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HAxgaQ46S1ghroYBVrhuLpblPgXjYN7228ME2Xg7WioM%2BKj0tijuZBMffY5SJFJOp%2F6CVz5McryvX7rfwM6gehcMO%2BnNh6tkqgBfLB%2BcErwmRPJyGWlKNNzfcmzWlR7IMw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b2c8694401-FRA
expires: Mon, 18 Oct 2021 16:46:15 GMT

GET
H2 200 v1.0.min.js Show response
cdn.jsdelivr.net/gh/vli-platform/adb-analytics@77bebb/ 8 KB
4 KB 54ms
21ms Script
application/javascript 104.16.85.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/vli-platform/adb-analytics@77bebb/v1.0.min.js

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a60f05241c10731fac30ffb51c6e79d0c0dc5592c835efb90618e6f736c9f729

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 39707
x-jsd-version: 77bebb
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19126-FRA
timing-allow-origin: *
x-jsd-version-type: branch
server: cloudflare
etag: W/"1e1a-TMun0KsWj4EaQvAPccpf5Lt0Xjk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 69eef5b30e9c413e-PRG

GET
H3 200 adblocker.png
mynewsmedia.co/edu/Linkpage/assets/img/ 34 KB
35 KB 39ms
37ms Image
image/png 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/img/adblocker.png
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e900e5ae80b3edc54ea9b2df7846ae84f246673337448b3a7b112c7a0b44f4d4

Request headers

:path: /edu/Linkpage/assets/img/adblocker.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392112
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 34963
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e4E6DxlllBJjMhIw2uMVSeQvmiavKvZEth6E%2FbhH7wJlW4%2BkXoeHwnehFmkr07mXijoxEvY2caIOHvrlvd9XacB6gt%2B%2BCWRoHWDEw8RppzuqdGD4ScluPjI%2B7RZ%2BnreHmA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b2d8764401-FRA
expires: Mon, 18 Oct 2021 16:46:30 GMT

GET
H2 200 4249477 Show response
in-page-push.com/400/ 84 KB
30 KB 74ms
29ms Script
application/javascript 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://in-page-push.com/400/4249477

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

064b3f19af62379c6e755b2f3934d84a5f4ce91fe363e898b59f2551d4982678

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-trace-id: ce1a1f6c0d234521de3455fdec6bfcac
pragma: no-cache
date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
strict-transport-security: max-age=1
timing-allow-origin: *
expires: Wed, 31 Dec 1969 19:00:00 EST

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 67ms
16ms Script
text/javascript 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-134987322-6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 16:38:54 GMT
server: Golfe2
age: 3286
date: Sat, 16 Oct 2021 04:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Sat, 16 Oct 2021 06:46:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 95 KB
38 KB 37ms
22ms Script
application/javascript 142.250.186.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-134987322-9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-134987322-6

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

44c959c31fe6675eceb4146a7cffb4072c251f031342640df4fab79c3b162bd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38558
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 16 Oct 2021 05:41:43 GMT

POST
H3 200 send Show response
vmuid.com/uid/ 65 B
845 B 87ms
60ms Fetch
application/json 104.21.90.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vmuid.com/uid/send
Requested by: Host: vmuid.com
URL: https://vmuid.com/script.js?sid=494e7bd8-4622-4312-97f0-3e90f1268f5e
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.90.9 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 682fddd6851c21dccf28f32c66dde96ed6f62d74c433743c51c00ace3de79c65

Request headers

Accept: application/json
Referer: https://mynewsmedia.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDid7i7x9aQcZN5N3

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-allow-headers: X-Requested-With, content-type, access-control-allow-origin, access-control-allow-methods, access-control-allow-headers, set-cookie, Cookie
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y0S%2F9SyMsQxmSnFLVCCXHIrDpI8%2BfnHVQ%2F2L0MmuckEYx0wnTmbGrJkckUxnhjXIglBA%2FeYJvU8idMyJAM0JoiEsZSoyR%2BGT%2B13hy%2BPx%2BnoR0hE74axmc%2Ff6Yak%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-store, max-age=0
access-control-allow-credentials: true
cf-ray: 69eef5b2fba9f9d6-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 nyc.php Show response
mynewsmedia.co//edu/Linkpage/ Frame 5780 93 B
650 B 1262ms
1262ms Document
text/html 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co//edu/Linkpage/nyc.php
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f135f9ffe01dc031a5aaf1de99077699eb689a78dbfc2434fbb62d7103d929cf

Request headers

:method: GET
:authority: mynewsmedia.co
:scheme: https
:path: //edu/Linkpage/nyc.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NuMa9rStIvoZvf9%2FZYvsGlC0oCIKJ2qefrbpNavVmmCFXeDxBKvAJR97apNVLq5CNohmUuEI1m4nKS%2B3gyEzoSQWB2AGP3rFkAHkZHaJl8Yyp1K%2FYjJQE9QwcJ1YrOBS7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 69eef5b2d8954401-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 nyc.php Show response
mynewsmedia.co//edu/Linkpage/ Frame 3265 93 B
650 B 1176ms
1176ms Document
text/html 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co//edu/Linkpage/nyc.php
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ae2593c46f5c98de8c7d71d16b318b83990cd9350427555fbf75ccf062c31b4

Request headers

:method: GET
:authority: mynewsmedia.co
:scheme: https
:path: //edu/Linkpage/nyc.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWQYmKVDU0rllnDsvYuzimdj%2BDhLfyvE3xH%2F01qALuKyu99GeXO6HVpopYQ9DYY2COz3koNDz35gFbSzY4NQ9MoHBzQyQtOOjYbI%2Fuvy8olxHMKB66guhp5AR0lpJ7nCTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 69eef5b2e8a04401-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ 23 KB
23 KB 49ms
16ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mynewsmedia.co
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 06:39:46 GMT
x-content-type-options: nosniff
age: 514917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23484
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:19:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 10 Oct 2022 06:39:46 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 22 KB
23 KB 39ms
7ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mynewsmedia.co
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 04:13:08 GMT
x-content-type-options: nosniff
age: 350915
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22992
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:18:57 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Oct 2022 04:13:08 GMT

GET
H3 200 fa-solid-900.woff2
mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/webfonts/ 78 KB
79 KB 12ms
12ms Font
font/woff2 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/webfonts/fa-solid-900.woff2
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/css/all.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7

Request headers

:path: /edu/Linkpage/assets/vendor/fontawesome-free/webfonts/fa-solid-900.woff2
pragma: no-cache
origin: https://mynewsmedia.co
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/css/all.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://mynewsmedia.co/edu/Linkpage/assets/vendor/fontawesome-free/css/all.min.css
Origin: https://mynewsmedia.co
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392112
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 80300
last-modified: Sat, 10 Apr 2021 18:04:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2fHtMC0PuBMxUXiaBCb2FB0bvg3209vIQJZt9yzIgseq5%2FOHYZeAN5vimSd0XVAvDVosNgAIqUP1w%2FyLGaZpPEDvxzqESsSjzfowyPAq8mnyAjEZOl9tg24sf8F6FFzo2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 69eef5b379bf4401-FRA
expires: Mon, 18 Oct 2021 16:46:31 GMT

GET
H2 200 / Show response
api.duckduckgo.com/ 1 KB
3 KB 123ms
49ms XHR
application/x-javascript 40.114.177.156
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.duckduckgo.com/?q=useragent&format=json

Requested by

Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

40.114.177.156 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

nginx /

Resource Hash

278e9b2b52f40811df066b93ee8335ec35260e10d2975bae8aeec6eca6437731

Security Headers

Name	Value
Content-Security-Policy	default-src 'none' ; connect-src https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ https://duck.co ; manifest-src https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; media-src https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; script-src blob: https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ 'unsafe-inline' 'unsafe-eval' ; font-src data: https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; img-src data: https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; style-src https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ 'unsafe-inline' ; object-src 'none' ; worker-src blob: ; child-src blob: https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; frame-src blob: https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; form-action https://duckduckgo.com https://.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ https://duck.co ; frame-ancestors 'self' ; base-uri 'self' ; block-all-mixed-content ;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:43 GMT
content-encoding: br
x-content-type-options: nosniff
server-timing: total;dur=17;desc="Backend Total"
x-xss-protection: 1;mode=block
x-duckduckgo-locale: de_DE
referrer-policy: origin
server: nginx
x-frame-options: SAMEORIGIN
expect-ct: max-age=0
vary: Accept-Encoding
strict-transport-security: max-age=31536000
content-type: application/x-javascript
access-control-allow-origin: *
x-duckduckgo-results: 1
cache-control: max-age=1
permissions-policy: interest-cohort=()
content-security-policy: default-src 'none' ; connect-src https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ https://duck.co ; manifest-src https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; media-src https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; script-src blob: https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ 'unsafe-inline' 'unsafe-eval' ; font-src data: https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; img-src data: https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; style-src https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ 'unsafe-inline' ; object-src 'none' ; worker-src blob: ; child-src blob: https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; frame-src blob: https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ ; form-action https://duckduckgo.com https://*.duckduckgo.com https://3g2upl4pq6kufc4m.onion/ https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ https://spreadprivacy.com/ https://duck.co ; frame-ancestors 'self' ; base-uri 'self' ; block-all-mixed-content ;
expires: Sat, 16 Oct 2021 05:41:44 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 38ms
24ms XHR
text/plain 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1944343076&t=pageview&_s=1&dl=https%3A%2F%2Fmynewsmedia.co%2Fedu%2Feducation-insurance-plans-that-pay-for-higher-education%2F&ul=en-us&de=UTF-8&dt=Free%20Hacking%20Webinar&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1499459355&gjid=229059406&cid=1221986007.1634362904&tid=UA-134987322-6&_gid=688212672.1634362904&_r=1&gtm=2ouad0&z=255409198

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mynewsmedia.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 29ms
24ms XHR
text/plain 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1944343076&t=pageview&_s=1&dl=https%3A%2F%2Fmynewsmedia.co%2Fedu%2Feducation-insurance-plans-that-pay-for-higher-education%2F&ul=en-us&de=UTF-8&dt=Free%20Hacking%20Webinar&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAUABAAAAAC~&jid=342035232&gjid=1754853528&cid=1221986007.1634362904&tid=UA-134987322-9&_gid=688212672.1634362904&_r=1&gtm=2ouad0&z=486465399

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mynewsmedia.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 ads_stats_controller.php Show response
mynewsmedia.co/edu/Linkpage/ 9 B
577 B 2156ms
2156ms XHR
text/html 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/ads_stats_controller.php
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/assets/vendor/jquery/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16f25902b2fa0600b369ce6a61b1a71e6801033033e3440129dd00523104e13d

Request headers

sec-fetch-mode: cors
origin: https://mynewsmedia.co
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: _ga=GA1.2.1221986007.1634362904; _gid=GA1.2.688212672.1634362904; _gat_gtag_UA_134987322_6=1; _gat_gtag_UA_134987322_9=1
content-length: 47
:path: /edu/Linkpage/ads_stats_controller.php
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: */*
cache-control: no-cache
:authority: mynewsmedia.co
referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Accept: */*
Referer: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Sat, 16 Oct 2021 05:41:45 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N0Tmq4irZqMyVSHSktQ8GrEegfJu7ZSlVV6KXK4TxI2ZTltPs5WxaA%2FWMmIUyhpkeF2vji2i3XV9oJJi6L3KdUN9lMa%2F3hjwFsnwkMQaZT71VEXMLWCVQswGNCB9%2FQ3ktQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5b43aef4401-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
459 B 43ms
15ms XHR
text/plain 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-134987322-9&cid=1221986007.1634362904&jid=342035232&gjid=1754853528&_gid=688212672.1634362904&_u=YEDAAUABAAAAAC~&z=1952039696

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mynewsmedia.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 16 Oct 2021 05:41:43 GMT
content-type: text/plain
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
543 B 47ms
13ms XHR
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js

Requested by

Host: in-page-push.com
URL: https://in-page-push.com/400/4249477

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4d364bbcd6deb87e5b7ab11dfb9bdb60c6a0c239b4a03b9996ff1e587d759aae

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:39 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mynewsmedia.co
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

OPTIONS
H2 200 4249477
in-page-push.com/500/ Frame 0
0 37ms
12ms Preflight 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://in-page-push.com/500/4249477?excludes=&oaid=f418cc4bc5fe4f2da1a323735af4685d&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=2&pl=https%3A%2F%2Fmynewsmedia.co%2Fedu%2Feducation-insurance-plans-that-pay-for-higher-education%2F&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false

Protocol

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://mynewsmedia.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Sat, 16 Oct 2021 05:41:39 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET
access-control-allow-origin: https://mynewsmedia.co
access-control-max-age: 300
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *

GET
H2 200 4249477 Show response
in-page-push.com/500/ 4 KB
2 KB 16ms
16ms XHR
application/javascript 139.45.197.15
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: in-page-push.com
URL: https://in-page-push.com/400/4249477

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.15 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

20f30ecc299295f476509042957c5e3fbe0000c9d0d8aef17bff274fd15601f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://mynewsmedia.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

x-trace-id: 3bd669ec6c0d5f66499932d73eb449be
pragma: no-cache
date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://mynewsmedia.co
access-control-expose-headers: Link
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=1
timing-allow-origin: *
expires: Wed, 31 Dec 1969 19:00:00 EST

GET
H/1.1 200
OK 0738745987824.png
static.cdnativepush.com/contents/s/27/37/a4/8fd12ad9d8597ca0ddca80c749/ 577 B
1 KB 59ms
11ms Image
image/png 139.45.197.156
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.cdnativepush.com/contents/s/27/37/a4/8fd12ad9d8597ca0ddca80c749/0738745987824.png
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/education-insurance-plans-that-pay-for-higher-education/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 139.45.197.156 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: b0e7fadc3bee4745eb7e38e7684dc1ab8ffb8639d16f1ebdc21cbca2f9dbcc0b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:44 GMT
Last-Modified: Thu, 21 Feb 2019 14:00:06 GMT
Server: nginx
ETag: "5c6eaee6-241"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Content-Length: 577

GET
H3 200 tg-925109.js Show response
mynewsmedia.co/edu/Linkpage/ Frame 3265 157 KB
47 KB 22ms
21ms Script
application/javascript 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co//edu/Linkpage/nyc.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82b13a24ceb7682e8bc5d7cc963d910191a4a5d9239e6614d6a0a24e092e6694

Request headers

:path: /edu/Linkpage/tg-925109.js
pragma: no-cache
cookie: _ga=GA1.2.1221986007.1634362904; _gid=GA1.2.688212672.1634362904; _gat_gtag_UA_134987322_6=1; _gat_gtag_UA_134987322_9=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mynewsmedia.co
referer: https://mynewsmedia.co//edu/Linkpage/nyc.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co//edu/Linkpage/nyc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392113
cf-polished: origSize=161215
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 03 May 2021 18:32:45 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8SvHibVUtEbgpNKHac0Km4IKTpoE8Op5ZeezQgjRbHJw%2BGIQd%2BkhkjWwYOAae2cEC8DPzoMyLbsOsJ0bcusNlETKtsydu9KY5sV%2BJ4%2FuR7VezTyjr8U1v5LZQV7IILhqKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5ba4cff4401-FRA
expires: Mon, 18 Oct 2021 16:46:31 GMT

GET
H2 204 utx Show response
nandlookfo.fun/ Frame 3265 0
412 B 135ms
99ms XHR
text/plain 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/utx?cb=2yZJ9HwTpkkv&top=mynewsmedia.co&tid=925109
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:44 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
x-amz-cf-id: tOOdEaSmitScxBBqssjIsp3z2AmQOaKj7gjtIOULMtoamYbWdg3KSw==

GET
H2 200 popunder.gif
ursegreatm.fun/ Frame 3265 35 B
367 B 145ms
98ms Image
image/gif 13.225.87.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ursegreatm.fun/popunder.gif
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co//edu/Linkpage/nyc.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-90.fra2.r.cloudfront.net
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
content-length: 58
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-amz-cf-id: qCEEh_LrHLunE6-DMPhweFlB4FGkEyCZ0xQx9ywh1_KAPQK2Hue1pw==

GET
H2 200 MEprSG1RKAglUlF3CW4YQiZWbV92b1kOCQEvGC0PUy4GfhpIfQFmDlwlHiwLQiUFPENeLx9tX3Y9OBwrdikFHRxoIxgdPlp7MgE4CQcOPz8AGwAwG2cwMiwqSiEmAgZpITsdDkcJEXw3ciAtBDxzei8RGmkaJxkVARwpIwJoMyEYOEkyDQIGCQ8JeSxYDy4gVHYwL... Show response
nandlookfo.fun/ Frame C6A9 3 KB
2 KB 130ms
99ms Document
text/html 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/MEprSG1RKAglUlF3CW4YQiZWbV92b1kOCQEvGC0PUy4GfhpIfQFmDlwlHiwLQiUFPENeLx9tX3Y9OBwrdikFHRxoIxgdPlp7MgE4CQcOPz8AGwAwG2cwMiwqSiEmAgZpITsdDkcJEXw3ciAtBDxzei8RGmkaJxkVARwpIwJoMyEYOEkyDQIGCQ8JeSxYDy4gVHYwLgsqWQMmBS9HGCcODkMCKQkZdjAqHD5zGA4YFUMQIR4vVxsvBlV4eT0QPwMhMQUFQygnHllJCz0KWnEZGA84eDkpLCh6KA4aPwIHLQpacR4iKioDci0RKHV5CQkjAQkABlR3DUYKLGIZAwojYn46GAFhJCwaGgkMIytdYQIEDwwADC8qLH57PCBZWBg4LwhlAh8xNHUILQI7Vz8teS8HCzgBNXYjIS0Pdi4jLTt5PioKAlscLAosfXkqCwwAAAkuPGIzOR4ZFXgtCQByCzkcHWEDEwUleQg5eyN1CF0KAEQIOnpUdS8qbgdDJQU4UFN+OjwbRTMgGFpEc14sXw
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 847b44cba9cff41592d14e57664048a6145c1836b2ddd29fed773d17d6ed7860

Request headers

:method: GET
:authority: nandlookfo.fun
:scheme: https
:path: /MEprSG1RKAglUlF3CW4YQiZWbV92b1kOCQEvGC0PUy4GfhpIfQFmDlwlHiwLQiUFPENeLx9tX3Y9OBwrdikFHRxoIxgdPlp7MgE4CQcOPz8AGwAwG2cwMiwqSiEmAgZpITsdDkcJEXw3ciAtBDxzei8RGmkaJxkVARwpIwJoMyEYOEkyDQIGCQ8JeSxYDy4gVHYwLgsqWQMmBS9HGCcODkMCKQkZdjAqHD5zGA4YFUMQIR4vVxsvBlV4eT0QPwMhMQUFQygnHllJCz0KWnEZGA84eDkpLCh6KA4aPwIHLQpacR4iKioDci0RKHV5CQkjAQkABlR3DUYKLGIZAwojYn46GAFhJCwaGgkMIytdYQIEDwwADC8qLH57PCBZWBg4LwhlAh8xNHUILQI7Vz8teS8HCzgBNXYjIS0Pdi4jLTt5PioKAlscLAosfXkqCwwAAAkuPGIzOR4ZFXgtCQByCzkcHWEDEwUleQg5eyN1CF0KAEQIOnpUdS8qbgdDJQU4UFN+OjwbRTMgGFpEc14sXw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mynewsmedia.co/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/

Response headers

content-type: text/html
content-length: 1241
date: Sat, 16 Oct 2021 05:41:44 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: lvWlJ4MFI5m-mIPZyjpjBjXd6EVpbHmJWLpJ_-8TgTbMkNFFvg84Uw==

GET
H3 200 tg-925110.js Show response
mynewsmedia.co/edu/Linkpage/ Frame 5780 157 KB
47 KB 29ms
28ms Script
application/javascript 104.21.51.98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co//edu/Linkpage/nyc.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.51.98 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e769d23fa2c1d5da32f37da7718937d583f7d34b9cc4071757c05f2a15a9eed0

Request headers

:path: /edu/Linkpage/tg-925110.js
pragma: no-cache
cookie: _ga=GA1.2.1221986007.1634362904; _gid=GA1.2.688212672.1634362904; _gat_gtag_UA_134987322_6=1; _gat_gtag_UA_134987322_9=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: mynewsmedia.co
referer: https://mynewsmedia.co//edu/Linkpage/nyc.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co//edu/Linkpage/nyc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 392113
cf-polished: origSize=161207
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 03 May 2021 18:35:13 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UN1J6fNJAOkfqndnWg0QUGJRpt29LUGv5crC1R6Krt98ebVuoT2CAYadAoxnjVSCHfVq%2FTMvkszzLQFlDZNLmXfALujp4P%2FscEWA9jbDvgxpPnIP3m0OVSIK2oAKd3xtow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 69eef5baddc24401-FRA
expires: Mon, 18 Oct 2021 16:46:31 GMT

GET
H2 200 / Show response
freychang.fun/ Frame 3265 16 B
713 B 161ms
117ms Fetch
text/plain 104.21.45.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/?f=68cb9cbd7e5818bd1a62d4ec74ab7d3d
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.45.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 291eaa4bdd8bb6792b403b109c54f812f93883699742e819e434bfbf595943f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://mynewsmedia.co
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qogn6tuLO7PrCyZDNGO%2BimHDN7UEQH9P1lavW45bP4CY4%2FyyNVDdQa4U7Oo7FM1A1czcDwT2CoS1dH5%2FS4nk%2FpLfBccm8TgSuFUWESO1KUjfkNY3Zkoaq6lAqEiFf1XK"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 69eef5bb486a2774-PRG
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 204 utx Show response
nandlookfo.fun/ Frame 5780 0
414 B 98ms
98ms XHR
text/plain 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/utx?cb=stgoW5Mcx0ke&top=mynewsmedia.co&tid=925110
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:44 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
x-amz-cf-id: 5p2ZmfDv4ZhT8MTKSUYbpzHnYhOJ76Z72Jdi1jMnOmXd8bULq0BlSg==

GET
H2 200 popunder.gif
ursegreatm.fun/ Frame 5780 35 B
367 B 187ms
187ms Image
image/gif 13.225.87.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ursegreatm.fun/popunder.gif
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-90.fra2.r.cloudfront.net
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
content-length: 58
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
x-amz-cf-id: eJ2SQCMWIS5CRc740E3T8XhxXACrLwNZe0LxTan-ZTitFOmBIPBu6A==

GET
H2 200 XDcwcnduByBRIloQNH0YeXMfRiFWJUhZGFkjTQJ4TSJABjdMNEM Show response
nandlookfo.fun/TjhVdTUvWjYYCi8FN1NAPFRoUAcIHWczUX9dJhBXLVw4Q0I2Dz9bViJXIBFTPFc7ARsgXSFQBwhQDxt/Pm45GnMGaTYCbxxxNzFiOlIDMFEXYmcFdAl6OkB7DGIFN2QPDxAwRSthFk1nHAk6A3kpXBAhTAdfFB4MFFsRLH0GeWAHUw91NjZYOk... Frame 4DFF 3 KB
2 KB 98ms
98ms Document
text/html 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/TjhVdTUvWjYYCi8FN1NAPFRoUAcIHWczUX9dJhBXLVw4Q0I2Dz9bViJXIBFTPFc7ARsgXSFQBwhQDxt/Pm45GnMGaTYCbxxxNzFiOlIDMFEXYmcFdAl6OkB7DGIFN2QPDxAwRSthFk1nHAk6A3kpXBAhTAdfFB4MFFsRLH0GeWAHUw91NjZYOkoEN3gAdhIRZhh6ZRh7HwkFPXEpHWc3dDZpFDpxdnsDN0J9YiIGUQtCbUd2JnYYL3c2bA0zWTRZEy9UBlJtRXQmCDA/bXdtBBJWJ15kJ3YZfw9FYyJcNDN9d20EHQFrChM7cwx/ATJgF2llN28CVS0mYn4VLR5UKVsWMmEhHWczcBxbGSVhA2sDREYfWmQjcxwKAwZkfnoPE18LdxcSZHheZCRNGn8HBHYmSxY4BndtBBIBNHcERVEfcBsaYyZ9Fz9xG3QTRU0lcBNMdxwKD0VgJVwwLG0caQQgTSVZPSBhCkI2GnF/XDcwcnduByBRIloQNH0YeXMfRiFWJUhZGFkjTQJ4TSJABjdMNEM
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: ac51ec5d1534cb040ef532a0574d70f4ed8d044bb869d96745fb469e590f1b51

Request headers

:method: GET
:authority: nandlookfo.fun
:scheme: https
:path: /TjhVdTUvWjYYCi8FN1NAPFRoUAcIHWczUX9dJhBXLVw4Q0I2Dz9bViJXIBFTPFc7ARsgXSFQBwhQDxt/Pm45GnMGaTYCbxxxNzFiOlIDMFEXYmcFdAl6OkB7DGIFN2QPDxAwRSthFk1nHAk6A3kpXBAhTAdfFB4MFFsRLH0GeWAHUw91NjZYOkoEN3gAdhIRZhh6ZRh7HwkFPXEpHWc3dDZpFDpxdnsDN0J9YiIGUQtCbUd2JnYYL3c2bA0zWTRZEy9UBlJtRXQmCDA/bXdtBBJWJ15kJ3YZfw9FYyJcNDN9d20EHQFrChM7cwx/ATJgF2llN28CVS0mYn4VLR5UKVsWMmEhHWczcBxbGSVhA2sDREYfWmQjcxwKAwZkfnoPE18LdxcSZHheZCRNGn8HBHYmSxY4BndtBBIBNHcERVEfcBsaYyZ9Fz9xG3QTRU0lcBNMdxwKD0VgJVwwLG0caQQgTSVZPSBhCkI2GnF/XDcwcnduByBRIloQNH0YeXMfRiFWJUhZGFkjTQJ4TSJABjdMNEM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mynewsmedia.co/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/

Response headers

content-type: text/html
content-length: 1240
date: Sat, 16 Oct 2021 05:41:44 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: r0aQ_v1iM0GtAYTOQY3BMmeSxsLLSLw-7fbVXR1qeAFDoqmcbAy_NQ==

GET
H2 200 / Show response
freychang.fun/ Frame 5780 16 B
338 B 117ms
116ms Fetch
text/plain 104.21.45.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/?f=68cb9cbd7e5818bd1a62d4ec74ab7d3d
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.45.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b658542929f551db37f360333eea805a7349f0cdb489ae94d0f34363c3080fb2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:44 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://mynewsmedia.co
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xHzdSElYnGcrJgAhsRmIitBVNSB7foIhw%2BgYv%2Bq51faKAgZMXUCs9RqyQFIose%2Fz%2FqPXmR55%2Bs9fTUTS6D7Q9z2PH4%2B1%2Fj4bAD7ls%2FDR8DABjLfpOq%2BH4OkgIQ1kBRwM"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 69eef5bb78b82774-PRG
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 floater Show response
nandlookfo.fun/ Frame 3265 1 KB
1 KB 500ms
500ms XHR
text/plain 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/floater?cs=NlNkSVYHZQUsYFVlU3k3VWdReWYG&abt=0&red=1&sm=83&k=&v=0.8.1.0&sts=0&prn=0&emb=1&tid=925109&fs=1&m=2&ns=1&ndp=1&asi=1&ref=https%3A%2F%2Fmynewsmedia.co%2F%2Fedu%2FLinkpage%2Fnyc.php&osr=mynewsmedia.co&jst=8&enr=0&lcua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F93.0.4577.63%20safari%2F537.36&tzd=0&uloc=&if=0&aa=td5_oi1_&_eslx=1634362904760&crc=1
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 72a75aad8a709e9def6cf52c6b8f5d0d3d67c51a1e0bee8ae09a8db09099287f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:45 GMT
content-encoding: gzip
server: openresty/1.17.8.2
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
content-type: text/plain
content-length: 881
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
x-amz-cf-id: FpR3fLT68qVgLc0h9GT41hsqnCoyQRD7hcewbxlhbwib-E1FKyEbSg==

GET
H2 200 AmBARTpQIxMHIBR3NEB6BmtBQ29EeA Show response
d1esebcdm6wx7j.cloudfront.net/wSTFFcnUqXisUSj1YIU9MewR0QkxvWzYdGzkMJkYkPUcwCz4ZBjFLQC0DYwYPLQx1VBkoXyJPUyxfJk9Eb1AhEEh9FzECGiIMMBwRLFcsHBAtFzATSCRePxsZJVBgQDN8H3VXR3kZMhsbLV4yAVB7ASsGUHsBdEJbeRR2MF... Frame C6A9 411 B
609 B 182ms
153ms Script
text/plain 13.32.23.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1esebcdm6wx7j.cloudfront.net/wSTFFcnUqXisUSj1YIU9MewR0QkxvWzYdGzkMJkYkPUcwCz4ZBjFLQC0DYwYPLQx1VBkoXyJPUyxfJk9Eb1AhEEh9FzECGiIMMBwRLFcsHBAtFzATSCRePxsZJVBgQDN8H3VXR3kZMhsbLV4yAVB7ASsGUHsBdEJbeRR2MFB7ATIbG38FYEE3bAN1CkN9GG-BARShBNR4QPlQnGRw9FHc0QHoGa0FDbAN1Wh4hRSgeUHtyYEBFJVguF1B7ASIXFiJebFdHeVItABokVGBAM3ACa0JbfQRyRVt/AmBARTpQIxMHIBR3NEB6BmtBQ29EeA
Requested by: Host: nandlookfo.fun
URL: https://nandlookfo.fun/MEprSG1RKAglUlF3CW4YQiZWbV92b1kOCQEvGC0PUy4GfhpIfQFmDlwlHiwLQiUFPENeLx9tX3Y9OBwrdikFHRxoIxgdPlp7MgE4CQcOPz8AGwAwG2cwMiwqSiEmAgZpITsdDkcJEXw3ciAtBDxzei8RGmkaJxkVARwpIwJoMyEYOEkyDQIGCQ8JeSxYDy4gVHYwLgsqWQMmBS9HGCcODkMCKQkZdjAqHD5zGA4YFUMQIR4vVxsvBlV4eT0QPwMhMQUFQygnHllJCz0KWnEZGA84eDkpLCh6KA4aPwIHLQpacR4iKioDci0RKHV5CQkjAQkABlR3DUYKLGIZAwojYn46GAFhJCwaGgkMIytdYQIEDwwADC8qLH57PCBZWBg4LwhlAh8xNHUILQI7Vz8teS8HCzgBNXYjIS0Pdi4jLTt5PioKAlscLAosfXkqCwwAAAkuPGIzOR4ZFXgtCQByCzkcHWEDEwUleQg5eyN1CF0KAEQIOnpUdS8qbgdDJQU4UFN+OjwbRTMgGFpEc14sXw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-200.fra56.r.cloudfront.net
Software: /
Resource Hash: a917b4e3ac7b96122fb7349d0abab60a337f63d2bd07129e3a8faff488bd2f87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://nandlookfo.fun/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:45 GMT
content-encoding: gzip
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 334
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
x-amz-cf-id: jnsFQreXezdrvHGq1AojawMdQ230zmW1vcmlF2_9U7NC5ca1jfeJAw==

GET
H2 200 ERcLPTMSV1sQb1VFR2VsQ0BZfjEOBgQ6f1QxTGRqChsCM39UQg4zOQ0dQHNoVhEBJDULF0xkHF9BR2Z0UkdeYXRQQUxkahUTDzcoD1dbEG9VRUdlbEAHVA Show response
d1esebcdm6wx7j.cloudfront.net/hZnJpVloFHQcwZRIbDWtjVEdYZ2pAGBo5NBZPBQA7EEpeYC8RR1ovLgdETyIgAk9ZcDYHHA5rfAMcCmtrQBMNNGdSVB0mNQ1PHDg+AxQAOD8CVBw3ZwsdEz82ChNMZBxTXFlzaFZaHj80Ah0eJX9UQgcif1RCWGZ0VldaFH... Frame 4DFF 411 B
610 B 161ms
161ms Script
text/plain 13.32.23.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1esebcdm6wx7j.cloudfront.net/hZnJpVloFHQcwZRIbDWtjVEdYZ2pAGBo5NBZPBQA7EEpeYC8RR1ovLgdETyIgAk9ZcDYHHA5rfAMcCmtrQBMNNGdSVB0mNQ1PHDg+AxQAOD8CVBw3ZwsdEz82ChNMZBxTXFlzaFZaHj80Ah0eJX9UQgcif1RCWGZ0VldaFH9UQh4/NFBGTGUYQ0BZLmxSW0-xkagcCGTo/ERcLPTMSV1sQb1VFR2VsQ0BZfjEOBgQ6f1QxTGRqChsCM39UQg4zOQ0dQHNoVhEBJDULF0xkHF9BR2Z0UkdeYXRQQUxkahUTDzcoD1dbEG9VRUdlbEAHVA
Requested by: Host: nandlookfo.fun
URL: https://nandlookfo.fun/TjhVdTUvWjYYCi8FN1NAPFRoUAcIHWczUX9dJhBXLVw4Q0I2Dz9bViJXIBFTPFc7ARsgXSFQBwhQDxt/Pm45GnMGaTYCbxxxNzFiOlIDMFEXYmcFdAl6OkB7DGIFN2QPDxAwRSthFk1nHAk6A3kpXBAhTAdfFB4MFFsRLH0GeWAHUw91NjZYOkoEN3gAdhIRZhh6ZRh7HwkFPXEpHWc3dDZpFDpxdnsDN0J9YiIGUQtCbUd2JnYYL3c2bA0zWTRZEy9UBlJtRXQmCDA/bXdtBBJWJ15kJ3YZfw9FYyJcNDN9d20EHQFrChM7cwx/ATJgF2llN28CVS0mYn4VLR5UKVsWMmEhHWczcBxbGSVhA2sDREYfWmQjcxwKAwZkfnoPE18LdxcSZHheZCRNGn8HBHYmSxY4BndtBBIBNHcERVEfcBsaYyZ9Fz9xG3QTRU0lcBNMdxwKD0VgJVwwLG0caQQgTSVZPSBhCkI2GnF/XDcwcnduByBRIloQNH0YeXMfRiFWJUhZGFkjTQJ4TSJABjdMNEM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-200.fra56.r.cloudfront.net
Software: /
Resource Hash: e96ad200a016b28bc936a063b2f505b6b1897824e75dcce9e0d711e7418d2b0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://nandlookfo.fun/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:45 GMT
content-encoding: gzip
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 333
via: 1.1 a4af9b42c2ec29f616825af32712c204.cloudfront.net (CloudFront)
x-amz-cf-id: Rl-It-QAzIS_6uNh8xVGSU-qjUkD6U_ghwNMDJGBnXGyS-aPcAxCFg==

GET
H2 200 floater Show response
nandlookfo.fun/ Frame 5780 2 KB
2 KB 496ms
496ms XHR
text/plain 13.225.87.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nandlookfo.fun/floater?cs=WU9lU1ZoeQQ2YDp5UmJma3tTYmZp&abt=0&red=1&sm=83&k=&v=0.8.1.0&sts=0&prn=0&emb=1&tid=925110&u=2213110097403923&fs=1&m=2&ns=1&ndp=1&asi=1&ref=https%3A%2F%2Fmynewsmedia.co%2F%2Fedu%2FLinkpage%2Fnyc.php&osr=mynewsmedia.co&jst=8&enr=0&lcua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F93.0.4577.63%20safari%2F537.36&tzd=0&uloc=&if=0&aa=td5_oi1_&_V2ub=1634362904881&crc=1
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-13.fra2.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: ccd3c7ad6d198ed26528fd10ee2815249faa38f4e896405d9c45eda164eb0d04

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 16 Oct 2021 05:41:45 GMT
content-encoding: gzip
server: openresty/1.17.8.2
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://mynewsmedia.co
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
content-type: text/plain
content-length: 1164
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
x-amz-cf-id: qiKOmbvXYYJIdZoAThzrqECxZ50znmM-Y4SauUwfuj7WoDsajfFV3g==

GET
H2 200 /
stats.vlitag.com/abd/ 0
557 B 162ms
120ms Image
image/jpeg 104.26.14.238
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stats.vlitag.com/abd/?id=0749d0aeb8637879e1cf64376484c635&detect=notfound
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.14.238 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mynewsmedia.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 16 Oct 2021 05:41:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W8vq9MBp980vX3ZZr8DjAsApz5WIcnzwV6RpyhiVuZnYKmqKtpRKiTJSnDdoQ6cp%2FUKzRltiAKiwB4wl%2Fg0LXdWNdHyY%2Bu8NKCKDVoBcs48Gw2Lu44FwtVGtIxm%2BvCKRc1U%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: no-cache, no-store, must-revalidate
cf-ray: 69eef5be5968413e-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 0

GET getlaid.jpeg
webpick-cdn.s3.us-west-2.amazonaws.com/ Frame 3265 0
0

GET
H/1.1 200
OK getlaid.jpeg
webpick-cdn.s3.us-west-2.amazonaws.com/ Frame C3E9 9 KB
9 KB 587ms
181ms Image
image/jpeg 52.218.233.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925109.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.233.193 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: e6a18e81d67bc6cfadbe2c86c78b99c0e01644cdeafb48144663121b629ea227

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:47 GMT
Last-Modified: Thu, 25 Jun 2020 08:18:14 GMT
Server: AmazonS3
x-amz-request-id: TG3D5NMX6VHVRGYY
ETag: "e73bda30c82b74c32e5f03e4ed4e4bb1"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 9313
x-amz-id-2: l2Ef50OoWkWXx59M8Cw6ZzK0j0/9zqqFsH3eFiRbqW1lbPx+ev0pBxswg2v2VTmB4qnU1RSc2LM=
x-amz-meta-s3b-last-modified: 20200625T081632Z

GET getlaid.jpeg
webpick-cdn.s3.us-west-2.amazonaws.com/ Frame 5780 0
0

GET
H/1.1 200
OK getlaid.jpeg
webpick-cdn.s3.us-west-2.amazonaws.com/ Frame 1D2B 9 KB
9 KB 533ms
173ms Image
image/jpeg 52.218.233.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg
Requested by: Host: mynewsmedia.co
URL: https://mynewsmedia.co/edu/Linkpage/tg-925110.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.233.193 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: e6a18e81d67bc6cfadbe2c86c78b99c0e01644cdeafb48144663121b629ea227

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 16 Oct 2021 05:41:48 GMT
Last-Modified: Thu, 25 Jun 2020 08:18:14 GMT
Server: AmazonS3
x-amz-request-id: YT151DF55VNRZQ1W
ETag: "e73bda30c82b74c32e5f03e4ed4e4bb1"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 9313
x-amz-id-2: QDUBsr21wN4EszqUVpXhvadtyz4WcEx/vr9J/uP3q6Fzw4zLUOcbamxSq48K1gniOJOHm0qGBug=
x-amz-meta-s3b-last-modified: 20200625T081632Z

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: webpick-cdn.s3.us-west-2.amazonaws.com
URL: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg

Domain: webpick-cdn.s3.us-west-2.amazonaws.com
URL: https://webpick-cdn.s3.us-west-2.amazonaws.com/getlaid.jpeg

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gplinks.co/	1969-12-31 23:59:59	Name: AppSession Value: b72b01856a8a04775395702a119f61a5
gplinks.co/	1969-12-31 23:59:59	Name: csrfToken Value: e0d1404e5cd012e98f9d3250810355b25fcbe89c5c2ab3df9cc8277009ca13b8e9ff0ddcf2ca52b50e17067e821260131126ce613e4c8443f1c8c33b624443ac
gplinks.co/	1970-01-19 22:00:49	Name: app_visitor Value: Q2FrZQ%3D%3D.NDRiNWU2OGZlZjlkMzMxNTM5OWRhOGY0OTM1YTU0Y2VjMjAxYzM2MmNhN2VkMDlhNWM5MWE1MGVkYWMwYTkwNZU5QuDixZKK5sXyvUfITZ1aU6wbQm%2BRoUAnEQA6rcZU4M%2FhAGUHZkmppqvrFCc%2BfyFG0QRYqULZhsNNjR4yEVWA9KPemYWgz2AIpv7BDFcV
.gplinks.co/	1970-01-19 21:59:24	Name: __cf_bm Value: 6s9eLq6TQXzks5qt1Ikvx5JHzZV.TJhwkOLLW1Q2i6M-1634362902-0-Abjoe3THI8SSwb8t4v1/5+yZIortORF9O9hr47lv4T2FnaYjhWWsh0lLvWti36MHUb9ctECwEfyerbQdysWSmd0=
yantrasbarges.com/	1970-01-19 22:00:49	Name: GL_UI4 Value: eJw9jUtOwzAYhPMOVUnESDkAR4hJi9sl4hAsI8f%2Bk5omduWYRtweCwlW82kemiiKkqZGfC9SpF%2FiiGfJiTP%2BIjk%2FsaHtDufXjsYj46eRHfhZKez02nsxzOQzPE5kyGnZS6uowlOI%2FpyrsZvJkA9OGFUhX0JjrlAOzm4ruSZFZsRCKN4vzgbNF%2FFpHZJzF1CbgHGLxK5NWu9Qfmijwq7eI2FtXRUR9rdZ%2BNG6pdeqiJFPTihC%2FIYHKTxN1n2jVLRevb0Bdlb9f%2F%2F3Nt1Yi0LRXcvwbf2F3A%2Fx6Uoh
yantrasbarges.com/	1970-01-19 22:00:49	Name: GL_GI10 Value: eJxNjsFOwzAQRFOHBixKq5H6AfwAkQwIcYY7lzRnK0q2kQ%2FdtewtEL6e0ErAbfRGbzRFUZjtGiZEbO7dU%2B0eXO3cY%2B2eHcqRBKZtsOrlyJomz92BcNNyUBpuG%2B2UMqpEYxCG2b3h%2Bpx9LwNh2TZ3%2F9jJtTtippyJcNEHnWBfErF%2BiAywP%2BCsrmb1ryhDjrDNcexSnriHZVKfI9HsvEqKkuYjWP%2FS00ZV4ipkH5N8TtUCGw0H%2BhImL%2Ft9Jr1cYvFemW%2B1KU2v
cinglecitrals.com/	1970-01-19 22:00:49	Name: GL_UI4 Value: eJw9jUtOwzAYhPMOVUnESDkAR4hJi9sl4hAsI8f%2Bk5omduWYRtweCwlW82kemiiKkqZGfC9SpF%2FiiGfJiTP%2BIjk%2FsaHtDufXjsYj46eRHfhZKez02nsxzOQzPE5kyGnZS6uowlOI%2FpyrsZvJkA9OGFUhX0JjrlAOzm4ruSZFZsRCKN4vzgbNF%2FFpHZJzF1CbgHGLxK5NWu9Qfmijwq7eI2FtXRUR9rdZ%2BNG6pdeqiJFPTihC%2FIYHKTxN1n2jVLRevb0Bdlb9f%2F%2F3Nt1Yi0LRXcvwbf2F3A%2Fx6Uoh
cinglecitrals.com/	1970-01-19 22:00:49	Name: GL_GI10 Value: eJxNjsFOwzAQRFOHBixKq5H6AfwAkQwIcYY7lzRnK0q2kQ%2FdtewtEL6e0ErAbfRGbzRFUZjtGiZEbO7dU%2B0eXO3cY%2B2eHcqRBKZtsOrlyJomz92BcNNyUBpuG%2B2UMqpEYxCG2b3h%2Bpx9LwNh2TZ3%2F9jJtTtippyJcNEHnWBfErF%2BiAywP%2BCsrmb1ryhDjrDNcexSnriHZVKfI9HsvEqKkuYjWP%2FS00ZV4ipkH5N8TtUCGw0H%2BhImL%2Ft9Jr1cYvFemW%2B1KU2v
.vmuid.com/	1970-01-21 10:52:19	Name: guid Value: 9f2f2e14-66cd-4374-a4a7-a942cad65dad
yookcasula.com/	1970-01-19 22:00:49	Name: GL_UI4 Value: eJw9jUtOwzAYhPMOVUnESDkAR4hJi9sl4hAsI8f%2Bk5omduWYRtweCwlW82kemiiKkqZGfC9SpF%2FiiGfJiTP%2BIjk%2FsaHtDufXjsYj46eRHfhZKez02nsxzOQzPE5kyGnZS6uowlOI%2FpyrsZvJkA9OGFUhX0JjrlAOzm4ruSZFZsRCKN4vzgbNF%2FFpHZJzF1CbgHGLxK5NWu9Qfmijwq7eI2FtXRUR9rdZ%2BNG6pdeqiJFPTihC%2FIYHKTxN1n2jVLRevb0Bdlb9f%2F%2F3Nt1Yi0LRXcvwbf2F3A%2Fx6Uoh
yookcasula.com/	1970-01-19 22:00:49	Name: GL_GI10 Value: eJxNjsFOwzAQRFOHBixKq5H6AfwAkQwIcYY7lzRnK0q2kQ%2FdtewtEL6e0ErAbfRGbzRFUZjtGiZEbO7dU%2B0eXO3cY%2B2eHcqRBKZtsOrlyJomz92BcNNyUBpuG%2B2UMqpEYxCG2b3h%2Bpx9LwNh2TZ3%2F9jJtTtippyJcNEHnWBfErF%2BiAywP%2BCsrmb1ryhDjrDNcexSnriHZVKfI9HsvEqKkuYjWP%2FS00ZV4ipkH5N8TtUCGw0H%2BhImL%2Ft9Jr1cYvFemW%2B1KU2v
.mynewsmedia.co/	1970-01-20 15:30:34	Name: _ga Value: GA1.2.1221986007.1634362904
.mynewsmedia.co/	1970-01-19 22:00:49	Name: _gid Value: GA1.2.688212672.1634362904
.mynewsmedia.co/	1970-01-19 21:59:22	Name: _gat_gtag_UA_134987322_6 Value: 1
.mynewsmedia.co/	1970-01-19 21:59:22	Name: _gat_gtag_UA_134987322_9 Value: 1
my.rtmark.net/	1970-01-20 06:44:58	Name: ID Value: f418cc4bc5fe4f2da1a323735af4685d
in-page-push.com/	1970-01-20 06:44:58	Name: OAID Value: f418cc4bc5fe4f2da1a323735af4685d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.duckduckgo.com
aptimorph.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
cinglecitrals.com
code.jquery.com
d1esebcdm6wx7j.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
freychang.fun
gplinks.co
gplinks.in
in-page-push.com
my.rtmark.net
mynewsmedia.co
nandlookfo.fun
static.cdnativepush.com
stats.g.doubleclick.net
stats.vlitag.com
ursegreatm.fun
vmuid.com
webpick-cdn.s3.us-west-2.amazonaws.com
www.google-analytics.com
www.googletagmanager.com
www.pnglib.com
yantrasbarges.com
yookcasula.com
webpick-cdn.s3.us-west-2.amazonaws.com
104.16.18.94
104.16.85.20
104.21.2.80
104.21.45.207
104.21.51.98
104.21.53.30
104.21.90.9
104.26.14.238
13.225.87.13
13.225.87.90
13.32.23.200
139.45.195.8
139.45.197.15
139.45.197.156
142.250.181.238
142.250.185.227
142.250.186.136
142.250.186.138
172.255.6.120
172.66.43.126
173.194.76.156
178.162.196.156
23.109.248.161
40.114.177.156
51.195.31.12
52.218.233.193
69.16.175.10
064b3f19af62379c6e755b2f3934d84a5f4ce91fe363e898b59f2551d4982678
0cac796e636db4a5146cf5fec25f59d180c0e6e3ab3135a2734a66cda24ade4c
0dd68ddab02aee119b41180171e8f053088bfc1eaca0d9811ba2713459e87ef3
16f25902b2fa0600b369ce6a61b1a71e6801033033e3440129dd00523104e13d
1c15ca9bca87b73ee3f65105657ed66ba35b7c7346ad9233fa169af78bd76ae8
20f30ecc299295f476509042957c5e3fbe0000c9d0d8aef17bff274fd15601f1
278e9b2b52f40811df066b93ee8335ec35260e10d2975bae8aeec6eca6437731
291eaa4bdd8bb6792b403b109c54f812f93883699742e819e434bfbf595943f6
334e714a1c5ebefb28783d1c809dda2a01b916554121e92067a2e41417cd10a2
33ad047d25a7047fe47f4de1a71f496e5543f07bc2fb2fd64c45869a47b70ba8
3bd289bc3518e2e20ff95271df4eb47c2db37ef7e113dd4be94029be8c8fa22e
44c959c31fe6675eceb4146a7cffb4072c251f031342640df4fab79c3b162bd0
4885da660044dd23d5d6aa035466a35f4064cb6b2f73eb762630266b516f3a08
4d364bbcd6deb87e5b7ab11dfb9bdb60c6a0c239b4a03b9996ff1e587d759aae
682fddd6851c21dccf28f32c66dde96ed6f62d74c433743c51c00ace3de79c65
6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71b337ac7fe7e8df7f9f8da261d03219901aa574e2819c5c726199078187c1a5
72a75aad8a709e9def6cf52c6b8f5d0d3d67c51a1e0bee8ae09a8db09099287f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
82b13a24ceb7682e8bc5d7cc963d910191a4a5d9239e6614d6a0a24e092e6694
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847b44cba9cff41592d14e57664048a6145c1836b2ddd29fed773d17d6ed7860
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8ae2593c46f5c98de8c7d71d16b318b83990cd9350427555fbf75ccf062c31b4
8b375a6d026f511bd11f82f63e180620cc6823ce0fc40e7fd7834863ba71b2e0
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8d6050216a4bae779bcca48452cb92f7b26a0bae6670496207ed927de8789e48
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
9134917f6baf04857feef6f3592a48791b656607b65c398f219a0ae567686124
a60f05241c10731fac30ffb51c6e79d0c0dc5592c835efb90618e6f736c9f729
a917b4e3ac7b96122fb7349d0abab60a337f63d2bd07129e3a8faff488bd2f87
ac51ec5d1534cb040ef532a0574d70f4ed8d044bb869d96745fb469e590f1b51
ac582238012cfcb44f7fcc53e190d365bc5f65e6840bd181d7a9d480e31506ff
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b0e7fadc3bee4745eb7e38e7684dc1ab8ffb8639d16f1ebdc21cbca2f9dbcc0b
b658542929f551db37f360333eea805a7349f0cdb489ae94d0f34363c3080fb2
b7848d86edc8dc3b5bc6a5c666069f9a31e000cee51575d3b6083951607e1550
bd3bbd3b9f8aaf2fa61ef7646899cda12097f7332fa3302bfbec50c80986fe24
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
ccd3c7ad6d198ed26528fd10ee2815249faa38f4e896405d9c45eda164eb0d04
d1a97123f6b810df7e528b6c8ad702d31f47e1afbfc73ba1dd05842e4c79de41
d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6a18e81d67bc6cfadbe2c86c78b99c0e01644cdeafb48144663121b629ea227
e769d23fa2c1d5da32f37da7718937d583f7d34b9cc4071757c05f2a15a9eed0
e900e5ae80b3edc54ea9b2df7846ae84f246673337448b3a7b112c7a0b44f4d4
e96ad200a016b28bc936a063b2f505b6b1897824e75dcce9e0d711e7418d2b0e
eb112d50f744cf58c2ebecb8a5b0d950c7f5a7a37c9842d21e2f678144dd149a
f135f9ffe01dc031a5aaf1de99077699eb689a78dbfc2434fbb62d7103d929cf
f2bb50caad0d651b2c4bbaca7d9335c99cf51b5580160bdbf3dbf6d3293e761f
f5f0b6e68dfaab5fdafeee920631895fa6c0e3ec2bfe7689fcc6247f854b772f
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

mynewsmedia.co Open in urlscan Pro 104.21.51.98 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

97 %HTTPS

0 %IPv6

27 Domains

27 Subdomains

27 IPs

6 Countries

844 kBTransfer

1724 kBSize

17 Cookies

2 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

mynewsmedia.co Open in urlscan Pro
104.21.51.98 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

97 %
HTTPS

0 %
IPv6

27
Domains

27
Subdomains

27
IPs

6
Countries

844 kB
Transfer

1724 kB
Size

17
Cookies

65 HTTP transactions
0 data transactions