creativedestructionmedia.com Open in urlscan Pro
2606:4700:3030::ac43:bfc6 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.ly/clnews-cdmedia
Effective URL:
https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-mor...
Submission: On December 27 via manual (December 27th 2022, 3:39:39 pm UTC) from BR — Scanned from DE

Summary HTTP 251 Redirects Links 50 Behaviour Indicators

Summary

This website contacted 56 IPs in 6 countries across 66 domains to perform 251 HTTP transactions. The main IP is 2606:4700:3030::ac43:bfc6, located in United States and belongs to CLOUDFLARENET, US. The main domain is creativedestructionmedia.com. The Cisco Umbrella rank of the primary domain is 744949.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 4th 2022. Valid for: a year.

This is the only time creativedestructionmedia.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
65	2606:4700:303... 2606:4700:3030::ac43:bfc6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
3	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
1	3.217.212.127 3.217.212.127	14618 (AMAZON-AES) (AMAZON-AES)
1 13	2a03:2880:f21... 2a03:2880:f21c:80e5:face:b00c:0:4420	32934 (FACEBOOK) (FACEBOOK)
6	192.124.249.69 192.124.249.69	30148 (SUCURI-SEC) (SUCURI-SEC)
6	2606:4700::68... 2606:4700::6812:e134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:a010	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2a00:1450:400... 2a00:1450:400d:806::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
3	54.187.119.242 54.187.119.242	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f22... 2a03:2880:f22d:c4:face:b00c:0:43fe	32934 (FACEBOOK) (FACEBOOK)
1	198.145.13.12 198.145.13.12	2044 (DF-PTL1) (DF-PTL1)
2	99.86.159.40 99.86.159.40	16509 (AMAZON-02) (AMAZON-02)
1	35.160.214.55 35.160.214.55	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
3	199.212.255.211 199.212.255.211	25948 (FHMNET) (FHMNET)
2	2a03:2880:f21... 2a03:2880:f21c:80c4:face:b00c:0:43fe	32934 (FACEBOOK) (FACEBOOK)
1	185.89.208.11 185.89.208.11	29990 (ASN-APPNEX) (ASN-APPNEX)
13	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
3	23.203.124.192 23.203.124.192	16625 (AKAMAI-AS) (AKAMAI-AS)
6	199.212.255.151 199.212.255.151	25948 (FHMNET) (FHMNET)
9	99.81.25.188 99.81.25.188	16509 (AMAZON-02) (AMAZON-02)
1 2	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:1901:0:8... 2600:1901:0:8344::	() ()
2	178.250.0.157 178.250.0.157	() ()
1	141.95.98.64 141.95.98.64	16276 (OVH) (OVH)
1	52.18.150.142 52.18.150.142	16509 (AMAZON-02) (AMAZON-02)
6	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
12	2606:4700:e4:... 2606:4700:e4::ac40:a903	() ()
4 5	37.252.171.85 37.252.171.85	() ()
2 2	13.248.245.213 13.248.245.213	() ()
1	3.124.221.254 3.124.221.254	() ()
2	2606:4700:10:... 2606:4700:10::6816:37ce	() ()
1	2a02:fa8:8806... 2a02:fa8:8806:12::1370	() ()
1	52.48.187.67 52.48.187.67	() ()
3 3	104.18.33.19 104.18.33.19	() ()
1	35.186.253.211 35.186.253.211	() ()
1	216.52.2.30 216.52.2.30	() ()
1	69.166.1.12 69.166.1.12	() ()
3 3	213.19.147.44 213.19.147.44	() ()
2 2	18.156.0.31 18.156.0.31	() ()
1 1	147.75.85.234 147.75.85.234	() ()
1 1	51.75.86.98 51.75.86.98	() ()
1	52.48.223.30 52.48.223.30	() ()
1	67.202.105.23 67.202.105.23	() ()
3 3	185.64.190.79 185.64.190.79	() ()
5 6	142.250.186.34 142.250.186.34	() ()
1 7	185.64.190.80 185.64.190.80	() ()
1 1	198.47.127.20 198.47.127.20	() ()
2 2	198.148.27.139 198.148.27.139	() ()
1	18.185.140.98 18.185.140.98	() ()
2 2	185.86.139.104 185.86.139.104	() ()
3 3	185.29.134.248 185.29.134.248	() ()
1 1	37.252.171.21 37.252.171.21	() ()
14	34.247.233.198 34.247.233.198	() ()
3 3	3.74.25.218 3.74.25.218	() ()
1 1	168.119.127.61 168.119.127.61	() ()
1 1	44.195.94.142 44.195.94.142	() ()
1 1	70.42.32.63 70.42.32.63	() ()
2 2	35.244.159.8 35.244.159.8	() ()
1	2a05:d018:d29... 2a05:d018:d29:3602:17a1:3e8:dac1:363e	() ()
1 1	54.210.175.101 54.210.175.101	() ()
1	150.136.26.45 150.136.26.45	() ()
1	8.18.47.7 8.18.47.7	() ()
2 2	151.101.66.49 151.101.66.49	() ()
2 2	18.156.32.70 18.156.32.70	() ()
2 2	185.184.8.90 185.184.8.90	() ()
1 1	23.64.52.128 23.64.52.128	() ()
2	23.2.211.147 23.2.211.147	() ()
1	198.47.127.19 198.47.127.19	() ()
2 2	213.155.156.168 213.155.156.168	() ()
1	178.250.2.151 178.250.2.151	() ()
1 1	2620:116:800d... 2620:116:800d:21:e365:4988:e8a7:3270	() ()
1	2606:4700:10:... 2606:4700:10::6816:1857	() ()
1	34.246.104.18 34.246.104.18	() ()
1	35.204.74.118 35.204.74.118	() ()
2 2	37.157.4.25 37.157.4.25	() ()
1	69.173.144.139 69.173.144.139	() ()
251	56

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

65 2606:4700:3030::ac43:bfc6 (United States)

ASN13335 (CLOUDFLARENET, US)

creativedestructionmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
my.creativedestructionmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.64.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.217.212.127 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-212-127.compute-1.amazonaws.com

classic.avantlink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a03:2880:f21c:80e5:face:b00c:0:4420 (Frankfurt am Main, Germany) 1 redirects

ASN32934 (FACEBOOK, US)

www.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.124.249.69 (Menifee, United States)

ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10069.sucuri.net

choiceclips.whatfinger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:a010 (United States)

ASN13335 (CLOUDFLARENET, US)

static.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:400d:806::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.187.119.242 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-119-242.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f22d:c4:face:b00c:0:43fe (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

scontent.cdninstagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.145.13.12 (United States)

ASN2044 (DF-PTL1, US)
PTR: getclicky.com

in.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.159.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-159-40.mxp64.r.cloudfront.net

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.160.214.55 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-160-214-55.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.212.255.211 (Canada)

ASN25948 (FHMNET, CA)

prebid.dblks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f21c:80c4:face:b00c:0:43fe (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

graph.instagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.208.11 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: prebid.ams3.adnexus.net

prebid.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

assets.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.203.124.192 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-203-124-192.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 199.212.255.151 (Canada)

ASN25948 (FHMNET, CA)

s.dblks.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 99.81.25.188 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com

trends.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
yeet.revcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::1c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:8344:: (None, )

ASN- ()

lexicon.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (None, )

ASN- ()

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.64 (France)

ASN16276 (OVH, FR)
PTR: ns3216658.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.150.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-150-142.eu-west-1.compute.amazonaws.com

id.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:e4::ac40:a903 (None, )

ASN- ()

s.0cf.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.252.171.85 (None, ) 4 redirects

ASN- ()

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (None, ) 2 redirects

ASN- ()

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.221.254 (None, )

ASN- ()

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:37ce (None, )

ASN- ()

cdn.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-eu.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1370 (None, )

ASN- ()

prebid-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.187.67 (None, )

ASN- ()

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.33.19 (None, ) 3 redirects

ASN- ()

ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (None, )

ASN- ()

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.30 (None, )

ASN- ()

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.166.1.12 (None, )

ASN- ()

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.19.147.44 (None, ) 3 redirects

ASN- ()

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (None, ) 2 redirects

ASN- ()

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.85.234 (None, ) 1 redirects

ASN- ()

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.75.86.98 (None, ) 1 redirects

ASN- ()

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.223.30 (None, )

ASN- ()

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.23 (None, )

ASN- ()

ssc-cms.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.79 (None, ) 3 redirects

ASN- ()

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.34 (None, ) 5 redirects

ASN- ()

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 185.64.190.80 (None, ) 1 redirects

ASN- ()

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.20 (None, ) 1 redirects

ASN- ()

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.148.27.139 (None, ) 2 redirects

ASN- ()

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.185.140.98 (None, )

ASN- ()

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.139.104 (None, ) 2 redirects

ASN- ()

ssbsync-global.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.134.248 (None, ) 3 redirects

ASN- ()

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.21 (None, ) 1 redirects

ASN- ()

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 34.247.233.198 (None, )

ASN- ()

usersync.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.74.25.218 (None, ) 3 redirects

ASN- ()

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 168.119.127.61 (None, ) 1 redirects

ASN- ()

bidswitch-eu.splicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.195.94.142 (None, ) 1 redirects

ASN- ()

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.63 (None, ) 1 redirects

ASN- ()

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (None, ) 2 redirects

ASN- ()

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:17a1:3e8:dac1:363e (None, )

ASN- ()

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.210.175.101 (None, ) 1 redirects

ASN- ()

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 150.136.26.45 (None, )

ASN- ()

sync.technoratimedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.18.47.7 (None, )

ASN- ()

match.deepintent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.66.49 (None, ) 2 redirects

ASN- ()

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.32.70 (None, ) 2 redirects

ASN- ()

cs.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (None, ) 2 redirects

ASN- ()

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.64.52.128 (None, ) 1 redirects

ASN- ()

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.2.211.147 (None, )

ASN- ()

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.19 (None, )

ASN- ()

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.168 (None, ) 2 redirects

ASN- ()

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.151 (None, )

ASN- ()

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:e365:4988:e8a7:3270 (None, ) 1 redirects

ASN- ()

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:1857 (None, )

ASN- ()

mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.104.18 (None, )

ASN- ()

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (None, )

ASN- ()

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.4.25 (None, ) 2 redirects

ASN- ()

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (None, )

ASN- ()

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
65	creativedestructionmedia.com creativedestructionmedia.com — Cisco Umbrella Rank: 744949 my.creativedestructionmedia.com	3 MB
22	revcontent.com assets.revcontent.com — Cisco Umbrella Rank: 6808 trends.revcontent.com — Cisco Umbrella Rank: 2202 yeet.revcontent.com — Cisco Umbrella Rank: 8632 img.revcontent.com — Cisco Umbrella Rank: 11230 cdn.revcontent.com — Cisco Umbrella Rank: 8686 images.revcontent.com — Cisco Umbrella Rank: 7648	144 KB
15	gumgum.com rtb.gumgum.com usersync.gumgum.com	5 KB
15	pubmatic.com 5 redirects ads.pubmatic.com — Cisco Umbrella Rank: 594 image8.pubmatic.com image2.pubmatic.com image4.pubmatic.com image6.pubmatic.com simage2.pubmatic.com	92 KB
15	gstatic.com fonts.gstatic.com	316 KB
15	instagram.com 1 redirects www.instagram.com — Cisco Umbrella Rank: 1156 graph.instagram.com — Cisco Umbrella Rank: 179	471 KB
12	0cf.io s.0cf.io	140 KB
9	dblks.net prebid.dblks.net — Cisco Umbrella Rank: 195677 s.dblks.net — Cisco Umbrella Rank: 204012	1 MB
9	doubleclick.net 5 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 251 cm.g.doubleclick.net	157 KB
7	adnxs.com 5 redirects prebid.adnxs.com — Cisco Umbrella Rank: 2396 ib.adnxs.com secure.adnxs.com	6 KB
7	w.org s.w.org — Cisco Umbrella Rank: 1902	8 KB
7	stripe.com js.stripe.com — Cisco Umbrella Rank: 2419 q.stripe.com — Cisco Umbrella Rank: 21619 m.stripe.com — Cisco Umbrella Rank: 2163	102 KB
6	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 441	2 KB
6	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3365 onesignal.com — Cisco Umbrella Rank: 1058 img.onesignal.com — Cisco Umbrella Rank: 7289	95 KB
6	whatfinger.com choiceclips.whatfinger.com — Cisco Umbrella Rank: 197842	624 KB
5	rubiconproject.com 1 redirects prebid-server.rubiconproject.com secure-assets.rubiconproject.com eus.rubiconproject.com token.rubiconproject.com pixel.rubiconproject.com Failed	12 KB
5	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 433 mug.criteo.com dis.criteo.com	2 KB
4	cdninstagram.com scontent.cdninstagram.com — Cisco Umbrella Rank: 543	43 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 111	5 KB
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	mathtag.com 3 redirects sync.mathtag.com	2 KB
3	yahoo.com 2 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	1 KB
3	1rx.io 3 redirects sync.1rx.io	2 KB
3	openx.net 2 redirects rtb.openx.net us-u.openx.net	778 B
3	casalemedia.com 3 redirects ssum.casalemedia.com ssum-sec.casalemedia.com	3 KB
3	getclicky.com static.getclicky.com — Cisco Umbrella Rank: 16525 in.getclicky.com — Cisco Umbrella Rank: 12908	6 KB
2	adform.net 2 redirects c1.adform.net	1 KB
2	de17a.com 2 redirects d5p.de17a.com	562 B
2	creativecdn.com 2 redirects creativecdn.com	701 B
2	emxdgt.com 2 redirects cs.emxdgt.com	529 B
2	everesttech.net 2 redirects sync-tm.everesttech.net	639 B
2	smartadserver.com 2 redirects ssbsync-global.smartadserver.com ssbsync.smartadserver.com	396 B
2	contextweb.com 2 redirects bh.contextweb.com	809 B
2	connectad.io cdn.connectad.io sync-eu.connectad.io	824 B
2	3lift.com 2 redirects eb2.3lift.com	786 B
2	crwdcntrl.net id.crwdcntrl.net — Cisco Umbrella Rank: 1794 sync.crwdcntrl.net	590 B
2	33across.com lexicon.33across.com ssc-cms.33across.com	258 B
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 2663	16 KB
1	simpli.fi um.simpli.fi	612 B
1	zeotap.com mwzeom.zeotap.com	382 B
1	quantserve.com 1 redirects cms.quantserve.com	590 B
1	deepintent.com match.deepintent.com	44 B
1	technoratimedia.com sync.technoratimedia.com	294 B
1	ipredictive.com 1 redirects sync.ipredictive.com	465 B
1	zemanta.com 1 redirects b1sync.zemanta.com	309 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com	590 B
1	splicky.com 1 redirects bidswitch-eu.splicky.com	221 B
1	sharethrough.com match.sharethrough.com
1	servenobid.com ads.servenobid.com	291 B
1	onetag-sys.com 1 redirects onetag-sys.com	129 B
1	a-mo.net 1 redirects prebid.a-mo.net	214 B
1	sonobi.com sync.go.sonobi.com	533 B
1	lijit.com ap.lijit.com
1	dotomi.com prebid-match.dotomi.com
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 510	638 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 324	2 KB
1	avantlink.com classic.avantlink.com — Cisco Umbrella Rank: 59347
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 5116	519 B
0	weborama.fr Failed idsync.frontend.weborama.fr Failed
0	amazon-adsystem.com Failed aax-eu.amazon-adsystem.com Failed
0	admanmedia.com Failed cs.admanmedia.com Failed
0	socdm.com Failed tg.socdm.com Failed
0	inmobi.com Failed sync.inmobi.com Failed
0	360yield.com Failed ad.360yield.com Failed
0	bing.com Failed c.bing.com Failed
0	rlcdn.com Failed api.rlcdn.com Failed
251	66

	Domain	Requested by
62	creativedestructionmedia.com	creativedestructionmedia.com
15	fonts.gstatic.com	fonts.googleapis.com
14	usersync.gumgum.com	rtb.gumgum.com ads.pubmatic.com
13	www.instagram.com	1 redirects creativedestructionmedia.com www.instagram.com
12	s.0cf.io	prebid.dblks.net s.0cf.io rtb.gumgum.com
7	s.w.org	creativedestructionmedia.com
6	cm.g.doubleclick.net	5 redirects rtb.gumgum.com
6	match.adsrvr.org	ads.pubmatic.com s.0cf.io rtb.gumgum.com
6	images.revcontent.com	creativedestructionmedia.com
6	yeet.revcontent.com	assets.revcontent.com
6	s.dblks.net	creativedestructionmedia.com
6	choiceclips.whatfinger.com	creativedestructionmedia.com
5	ib.adnxs.com	4 redirects
5	assets.revcontent.com	prebid.dblks.net assets.revcontent.com
4	image2.pubmatic.com	1 redirects ads.pubmatic.com
4	scontent.cdninstagram.com	www.instagram.com
4	fonts.googleapis.com	creativedestructionmedia.com client
3	simage2.pubmatic.com	ads.pubmatic.com
3	x.bidswitch.net	3 redirects
3	sync.mathtag.com	3 redirects
3	image8.pubmatic.com	3 redirects
3	sync.1rx.io	3 redirects
3	trends.revcontent.com	assets.revcontent.com
3	ads.pubmatic.com	assets.revcontent.com rtb.gumgum.com ads.pubmatic.com
3	prebid.dblks.net	creativedestructionmedia.com prebid.dblks.net
3	securepubads.g.doubleclick.net	creativedestructionmedia.com securepubads.g.doubleclick.net
3	onesignal.com	cdn.onesignal.com
3	q.stripe.com	creativedestructionmedia.com
3	my.creativedestructionmedia.com	creativedestructionmedia.com
3	js.stripe.com	creativedestructionmedia.com js.stripe.com
2	c1.adform.net	2 redirects
2	d5p.de17a.com	2 redirects
2	eus.rubiconproject.com	rtb.gumgum.com eus.rubiconproject.com
2	creativecdn.com	2 redirects
2	cs.emxdgt.com	2 redirects
2	sync-tm.everesttech.net	2 redirects
2	us-u.openx.net	2 redirects
2	bh.contextweb.com	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	ssum.casalemedia.com	2 redirects
2	eb2.3lift.com	2 redirects
2	mug.criteo.com
2	gum.criteo.com	1 redirects
2	graph.instagram.com	www.instagram.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	static.getclicky.com	creativedestructionmedia.com
2	cdn.onesignal.com	creativedestructionmedia.com cdn.onesignal.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	um.simpli.fi	ads.pubmatic.com
1	sync.crwdcntrl.net	ads.pubmatic.com
1	mwzeom.zeotap.com	ads.pubmatic.com
1	cms.quantserve.com	1 redirects
1	dis.criteo.com	ads.pubmatic.com
1	image6.pubmatic.com	ads.pubmatic.com
1	secure-assets.rubiconproject.com	1 redirects
1	ssum-sec.casalemedia.com	1 redirects
1	ssbsync.smartadserver.com	1 redirects
1	match.deepintent.com	rtb.gumgum.com
1	sync.technoratimedia.com	rtb.gumgum.com
1	sync.ipredictive.com	1 redirects
1	pr-bh.ybp.yahoo.com	rtb.gumgum.com
1	b1sync.zemanta.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	bidswitch-eu.splicky.com	1 redirects
1	secure.adnxs.com	1 redirects
1	sync-eu.connectad.io	cdn.connectad.io
1	ssbsync-global.smartadserver.com	1 redirects
1	match.sharethrough.com	s.0cf.io
1	image4.pubmatic.com	1 redirects
1	ssc-cms.33across.com	s.0cf.io
1	ads.servenobid.com	s.0cf.io
1	onetag-sys.com	1 redirects
1	prebid.a-mo.net	1 redirects
1	sync.go.sonobi.com	s.0cf.io
1	ap.lijit.com	s.0cf.io
1	rtb.openx.net	s.0cf.io
1	rtb.gumgum.com	s.0cf.io
1	prebid-match.dotomi.com	s.0cf.io
1	cdn.connectad.io	s.0cf.io
1	prebid-server.rubiconproject.com	s.0cf.io
1	id.crwdcntrl.net	ads.pubmatic.com
1	id5-sync.com	ads.pubmatic.com
1	lexicon.33across.com	ads.pubmatic.com
1	cdn.revcontent.com	creativedestructionmedia.com
1	img.revcontent.com	creativedestructionmedia.com
1	prebid.adnxs.com	prebid.dblks.net
1	img.onesignal.com	creativedestructionmedia.com
1	m.stripe.com	m.stripe.network
1	in.getclicky.com	static.getclicky.com
1	cdnjs.cloudflare.com	creativedestructionmedia.com
1	classic.avantlink.com	creativedestructionmedia.com
1	bit.ly	1 redirects
0	pixel.rubiconproject.com Failed	eus.rubiconproject.com
0	idsync.frontend.weborama.fr Failed	ads.pubmatic.com
0	aax-eu.amazon-adsystem.com Failed	ads.pubmatic.com
0	cs.admanmedia.com Failed	rtb.gumgum.com
0	tg.socdm.com Failed	rtb.gumgum.com
0	sync.inmobi.com Failed	rtb.gumgum.com
0	ad.360yield.com Failed	rtb.gumgum.com
0	c.bing.com Failed	rtb.gumgum.com
0	api.rlcdn.com Failed	ads.pubmatic.com
251	101

This site contains links to these domains. Also see Links.

Domain
t.me
cdmespanol.com
tsarizm.com
thebalkan.press
tsionizm.com
www.georgiarecord.com
connecticutcentinal.com
miamiindependent.com
themanhattan.press
armedforces.press
telegram.me
vkontakte.ru
3p3x.adj.st
gab.com
www.minds.com
rumble.com
tv.gab.com
gettr.com
truthsocial.com
en.wikipedia.org
my.creativedestructionmedia.com
trends.revcontent.com
help.revcontent.com
www.revcontent.com
brazil
www.youtube.com
celular
brasil
choiceclips.whatfinger.com
www.whatfinger.com
www.bitchute.com
commerce.coinbase.com
clicky.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-04` - `2023-06-03`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2022-12-15` - `2024-01-11`	a year	crt.sh
avantlink.com Amazon	`2022-03-30` - `2023-04-28`	a year	crt.sh
choiceclips.whatfinger.com Go Daddy Secure Certificate Authority - G2	`2022-08-06` - `2023-08-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.www.instagram.com DigiCert SHA2 High Assurance Server CA	`2022-10-05` - `2023-01-03`	3 months	crt.sh
*.w.org Sectigo ECC Domain Validation Secure Server CA	`2022-12-06` - `2024-01-06`	a year	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-11-12` - `2023-03-09`	4 months	crt.sh
*.instagram.com DigiCert SHA2 High Assurance Server CA	`2022-10-05` - `2023-01-03`	3 months	crt.sh
*.getclicky.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-01` - `2023-09-01`	a year	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-15` - `2023-01-26`	4 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
prebid.dblks.net R3	`2022-10-18` - `2023-01-16`	3 months	crt.sh
*.graph.instagram.com DigiCert SHA2 High Assurance Server CA	`2022-10-05` - `2023-01-03`	3 months	crt.sh
prebid.adnxs.com GeoTrust TLS RSA CA G1	`2022-05-26` - `2023-06-26`	a year	crt.sh
assets.revcontent.com R3	`2022-11-13` - `2023-02-11`	3 months	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.dblks.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-23` - `2023-07-22`	9 months	crt.sh
revcontent.com Amazon	`2022-06-16` - `2023-07-16`	a year	crt.sh
img.revcontent.com R3	`2022-11-13` - `2023-02-11`	3 months	crt.sh
cdn.revcontent.com R3	`2022-11-09` - `2023-02-07`	3 months	crt.sh
images.revcontent.com R3	`2022-11-06` - `2023-02-04`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-10-31` - `2023-01-26`	3 months	crt.sh
lexicon.33across.com GTS CA 1D4	`2022-12-21` - `2023-03-21`	3 months	crt.sh
*.id5-sync.com R3	`2022-11-09` - `2023-02-07`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.0cf.io E1	`2022-11-21` - `2023-02-19`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
connectad.io Cloudflare Inc ECC CA-3	`2022-04-15` - `2023-04-15`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2022-08-09` - `2023-09-10`	a year	crt.sh
gumgum.com Amazon	`2022-09-06` - `2023-10-05`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2022-06-27` - `2023-06-05`	a year	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2021-12-08` - `2023-01-09`	a year	crt.sh
ads.servenobid.com Amazon	`2022-05-29` - `2023-06-27`	a year	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-06` - `2023-09-30`	a year	crt.sh
*.sharethrough.com Amazon	`2022-07-14` - `2023-08-12`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-11-08` - `2023-05-03`	6 months	crt.sh
*.technoratimedia.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-15` - `2023-09-15`	a year	crt.sh
*.deepintent.com Go Daddy Secure Certificate Authority - G2	`2022-05-02` - `2023-06-03`	a year	crt.sh
*.ad-server.k8s.ie.ggops.com Amazon	`2022-02-15` - `2023-03-16`	a year	crt.sh
*.simpli.fi DigiCert TLS RSA SHA256 2020 CA1	`2022-11-07` - `2023-12-08`	a year	crt.sh

This page contains 51 frames:

Primary Page: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Frame ID: 255F81C46342F18BA7C7187B36EDE2ED
Requests: 144 HTTP requests in this frame

Frame: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Frame ID: 88949A9DB2C07C31755F7568693C6F70
Requests: 16 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-da551b803dc55c2dc0b4b9bdfeabba62.html
Frame ID: 4E70464DE12258D051F2D946891967AF
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: F05ACAD2E2452B754B75F21BAB60FC3B
Requests: 4 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130843008387167&mime=image/jpeg
Frame ID: C4FC3F8DD4035F2450CDD2B33818466D
Requests: 1 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130866630707295&mime=image/jpeg
Frame ID: A4102F09A0B9616BBA9DB03D23BB24B1
Requests: 1 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130890253027423&mime=image/jpeg
Frame ID: 821FAEE2070D3E19DBC4D7D649C50711
Requests: 1 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130913875347551&mime=image/jpeg
Frame ID: 812DE6E7AD322014F99FBA80AC44BDB1
Requests: 1 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130937497667679&mime=image/jpeg
Frame ID: 3046F28A5661C4BBF381979069D67DCE
Requests: 1 HTTP requests in this frame

Frame: https://s.dblks.net/i/15/?fcid=130961119987807&mime=image/jpeg
Frame ID: B36AF082DC7B586E4922D2FBF6C328B1
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Frame ID: 2C617B422274DAFA2CB52801E0B56A0F
Requests: 5 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: 19259E236D1D2F2F0F9BEC5AC677C6CE
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php?gdpr=0&consent=0&us_privacy=0&cb=https%3A//prebid.adnxs.com/pbs/v1/setuid%3Fbidder%3Dconnectad%26gdpr%3D%0%26gdpr_consent%3D0%26uid%3D86%26uid%3D
Frame ID: 0C5B710B6AEE223E3BF0E53674FAD9DE
Requests: 1 HTTP requests in this frame

Frame: https://prebid-match.dotomi.com/match/bounce/current?version=1&networkId=72582&rurl=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D10%26uid%3D
Frame ID: E20C11BBB39370BEE12329095A29332A
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Frame ID: 53CC064D45A6D40F25D6A7DB44F629AC
Requests: 15 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: 2987CFBAF29F434409A6099E7A4D73E3
Requests: 1 HTTP requests in this frame

Frame: https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D19%26uid%3D%24%7BUID%7D
Frame ID: 809D87FC5B2FDF62B2270CED81BBAF72
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D25%26uid%3D%24UID
Frame ID: B1150317875CCFBBD27EC5F5CFA7E32A
Requests: 1 HTTP requests in this frame

Frame: https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D26%26uid%3D%5BUID%5D
Frame ID: 6CE5930AD371CB8C1C73FD70E0A3CCE0
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=470582723
Frame ID: 82FBE9478BD0F74FBC976B6D65D3ECE0
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: A199CE23476B5EF805E4CBE7F03CB4E0
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: 6346033C45B0E78CDEC68DC0FE58F4DD
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/ps/?ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=84&uid=
Frame ID: 7D7F4B85F963592BA2DE05DEA1ACEB54
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?gdpr_58=&gdpr_consent=&ts=&ri=70&ru=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D1%26uid%3D33XUSERID33X
Frame ID: A6653A9F2D4E305D04D4B25389CBBABF
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: C1DFB636AE4C984B3E9D1F6CF6AB8458
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: EDA455F1C8A6BAF3B0E3441676907575
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/universal/v1?supply_id=Uj448boa
Frame ID: 297A004BF77256D7BB608B1E634D568E
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: 8CDA5A4914FA9A0E1538D328ADE66C29
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/ps/?dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e
Frame ID: 44836F83D4037864CF4F8B791DA1513F
Requests: 1 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: F412ACE0F7FC5FA31AA852514E0BE7F3
Requests: 1 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1?gdpr=0&consent=0&us_privacy=0&cb=https%3A//prebid.adnxs.com/pbs/v1/setuid%3Fbidder%3Dconnectad%26gdpr%3D%0%26gdpr_consent%3D0%26uid%3D86%26uid%3D
Frame ID: 1EF70C790E54386F28BD8254AE264A65
Requests: 1 HTTP requests in this frame

Frame: https://sync.inmobi.com/oRTB?gdpr_consent=0&gdpr=0&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dinm%26i%3D%7BID5UID%7D
Frame ID: D80253900A95CBBAC6E2B441FAA58D3D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Frame ID: 101EE73EEE2A9812AF4437846F1B0EED
Requests: 10 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=0
Frame ID: 6BB4F33911BDB1BD5F2C9B843BB05849
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=bacf63ab-11bb-4300-ae0b-cfc904cec643&gdpr=0&gdpr_consent=0
Frame ID: D54996DE8D7EEB650D971F0FAB1A4CB4
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=Y6sRuwAHKo4KpwAo&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo
Frame ID: 9D1F9AB7A3F5C4D028849A8CD4981E5A
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV8wYWI4OWM5Mi1lNzAzLTRkNDItOTk3NC01ZjA0Y2RiMzRjMGM=&gdpr=0&gdpr_consent=0
Frame ID: B4C4D492EB38D583AEE5BB93127444DB
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=emx&i=2706312133842823575brt50851672155579284796f1
Frame ID: D41EB370584758282F9743F46BF9CC67
Requests: 1 HTTP requests in this frame

Frame: https://tg.socdm.com/aux/idsync?proto=gumgum
Frame ID: E7327307CCE5FB6396DBD6C0777166A2
Requests: 1 HTTP requests in this frame

Frame: https://cs.admanmedia.com/sync/gumgum?puid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=0&ccpa=
Frame ID: 704FBF9C55D572AFD205901BA3DC7B6D
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=iex&i=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115
Frame ID: FF031763457013667E42479745E3DAA1
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=iZmCIAvYAtdwjxXZ7wXh&pi=gumgum&tc=1
Frame ID: 97A1D2FDA39C3906ECC376AD0EE25202
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 984BBFF592BFF0355AD80AB9D863225D
Requests: 4 HTTP requests in this frame

Frame: https://s.0cf.io/
Frame ID: 861846E6CA7B28C1F4FA20EAC71900F7
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:56a563ab-11bb-4500-8f28-67cccb48fd5a&gdpr=0&gdpr_consent=
Frame ID: F3EAE3409743D332E250966E7C554B6A
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7218457549909024635
Frame ID: AFA859DCD901BBC7FE3D18480196CCE3
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 65824F00BDC447B59917A1164DA072DF
Requests: 1 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent=&dcc=t
Frame ID: 7F87C19E96B1B8828522DC9BF180A124
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2706312133842823575&gdpr=0&gdpr_consent=
Frame ID: FBC773D096DC11E5136899655BCAAAC0
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=0DDzKNcy8CjLO_Z_gjq_KIM1p37LMqt5hDL8LytP
Frame ID: C9B390099CA30374388821CA2CD9069E
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=A7886AED-1531-47E1-8A6D-91D712C23C05
Frame ID: BB45F2F4F545ADE632967B102D5281E5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SUSPICIOUS ELECTIONS IN BRAZIL: FORENSIC ANALYSIS DEMONSTRATES EVEN MORE EVIDENCE OF FALSEHOOD IN BRAZILIAN ELECTION DATA- AS IF IT WERE NEEDED - CD Media

Page URL History Show full URLs

http://bit.ly/clnews-cdmedia HTTP 301
https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-d... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Clicky (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.getclicky\.com

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

251
Requests

90 %
HTTPS

22 %
IPv6

66
Domains

101
Subdomains

56
IPs

6
Countries

6540 kB
Transfer

12019 kB
Size

15
Cookies

50 Outgoing links

These are links going to different origins than the main page.

URL: https://t.me/ContactTele
Title: Telegram

Search URL Search Domain Scan URL

URL: https://cdmespanol.com/
Title: CDM Español

Search URL Search Domain Scan URL

URL: https://tsarizm.com/
Title: Tsarizm (Eastern Europe/Middle East)

Search URL Search Domain Scan URL

URL: https://thebalkan.press/
Title: The Balkan (Balkan News)

Search URL Search Domain Scan URL

URL: https://tsionizm.com/
Title: Tsionizm (Israel)

Search URL Search Domain Scan URL

URL: https://www.georgiarecord.com/
Title: The Georgia Record/Johns Creek Post

Search URL Search Domain Scan URL

URL: https://connecticutcentinal.com/
Title: Connecticut Centinal

Search URL Search Domain Scan URL

URL: https://miamiindependent.com/
Title: The Miami Independent

Search URL Search Domain Scan URL

URL: https://themanhattan.press/
Title: The Manhattan

Search URL Search Domain Scan URL

URL: https://armedforces.press/
Title: Armed Forces Press

Search URL Search Domain Scan URL

URL: https://tsarizm.com/sections/book-reviews/
Title: Book Reviews

Search URL Search Domain Scan URL

URL: https://tsarizm.com/sections/travel/
Title: Vagabond Travels

Search URL Search Domain Scan URL

URL: https://tsarizm.com/sections/short-stories/
Title: Short Stories

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https%3A%2F%2Fcreativedestructionmedia.com%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F&text=SUSPICIOUS%20ELECTIONS%20IN%20BRAZIL%3A%20FORENSIC%20ANALYSIS%20DEMONSTRATES%20EVEN%20MORE%20EVIDENCE%20OF%20FALSEHOOD%20IN%20BRAZILIAN%20ELECTION%20DATA-%20AS%20IF%20IT%20WERE%20NEEDED

Search URL Search Domain Scan URL

URL: https://vkontakte.ru/share.php?url=https%3A%2F%2Fcreativedestructionmedia.com%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F

Search URL Search Domain Scan URL

URL: https://3p3x.adj.st/?adjust_t=u783g1_kw9yml&adjust_fallback=https%3A%2F%2Fwww.viber.com%2F%3Futm_source%3DPartner%26utm_medium%3DSharebutton%26utm_campaign%3DDefualt&adjust_campaign=Sharebutton&adjust_deeplink=%20+%20encodeURIComponent(viber://forward?text=%20+%20encodeURIComponent(SUSPICIOUS%20ELECTIONS%20IN%20BRAZIL:%20FORENSIC%20ANALYSIS%20DEMONSTRATES%20EVEN%20MORE%20EVIDENCE%20OF%20FALSEHOOD%20IN%20BRAZILIAN%20ELECTION%20DATA-%20AS%20IF%20IT%20WERE%20NEEDED%20+%20%20%20+%20https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/))

Search URL Search Domain Scan URL

URL: https://gab.com/CreativeDestructionMedia
Title: Gab

Search URL Search Domain Scan URL

URL: https://www.minds.com/LToddWood/
Title: Minds

Search URL Search Domain Scan URL

URL: https://t.me/CreativeDestructionMedia
Title: Telegram

Search URL Search Domain Scan URL

URL: https://rumble.com/c/CDMedia
Title: Rumble

Search URL Search Domain Scan URL

URL: https://tv.gab.com/channel/CreativeDestructionMedia
Title: Gab TV

Search URL Search Domain Scan URL

URL: https://gettr.com/user/cdmedia
Title: GETTR

Search URL Search Domain Scan URL

URL: https://truthsocial.com/@CDMedia
Title: Truth Social

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Operation_Car_Wash)
Title: “Operation Carwash”.

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Benford%27s_law
Title: Benford’s law

Search URL Search Domain Scan URL

URL: https://my.creativedestructionmedia.com/
Title: ‘NO AD’ subscription for CDM! Sign up here and support real investigative journalism and help save the republic!‘

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=EQKIIHY3B9Ug2bbAB%2Fo7AxQJ7KSqW7hlppmz5YsqgudEq%2BGluF2mBjyMG2NvbPPz48CWJWdNbDrA2a4JzXioayd0C%2BA7ZY7%2BehpXWp%2FU%2Fux6RXgWvpfVX3mMJQAv2TKtt8xjM6a4wwWpwZXaxVlH8ssNQTq53GiI%2BwTJY2AEm3jx%2FtYg7QW%2BvoDGuqFthUAUkVOxpu024UalT4AFbiXX6dlR6U8Gwpuf9JHFI2Oqhu1Bv%2FZfPe3gOtvf%2Fcsw0iZN2Hfb8SNXVTMKqtOyg4OI7VlWyOY1S3ZcP5FM%2BP4VYAAZHiopEu1HVQYZofyOBW%2B2cZkrEp%2B7WBX8%2FKQU%2FaIKr7RYpN6n%2ByU%2BU%2BAcx%2F6EnjiSEmtfZKl5DoNZbZ7sV6IL8rsmAvaxhSNkN00uKSEJ%2B4PgljJHgA8CfOQHMtot5ahHT2IDbbnZZZ5x294xyMKLmQO%2FaOjJp4f%2BNMSLzq%2BWV1GaAN1KU8bvT3uhr%2F%2BdXxMLvC8lcOGlO1%2BFkdrMpQYFJqADjU1yN%2F%2BrCvCRfvqWEq%2Fj%2BOspxsApiLVYnDw8OCZP8Zf3tebi77bgXPBL76is6c8GEZcU%2B02saZm86dkzgM75e4qBoFr1eIBCX8V9ungwA9UyBnMSbDUfKNPqYY7rI06XR%2BZXwdNcPpyiYyBlvTmShKK7TID7pNam4QrxtmLPSDAMk868PvP8ZlPa0IlBIf3apWk9JqYCUCZr0Lv%2Bn6DxLzJjjwTHfdWOmE7CapVkISmqgTJ4yRiPRQ4NFw82%2FS2vqsB1hybJBmD7GodDB18eFOx7PQTteIDH0llgnJDFa0ovnfgz3OfBUOBkNdaBGSBO0n2du5oiM%2BB%2Fi16Jr85KGnpWvx2oNDtUCQskXIXgN4iq7jIIv3fZM%2FsTo7CHASKSoROeusRbcpy9AtFnEwzU2OVnXMfjHWkwqMeJeD9xxVdOAxN%2BE6SS2K2NvxmErsHlxK988vv35AfTAyZ%2FUxZWCSsOsU1NbX3CPMfYqAiotc%2FLErkpclhYYMjKF95RYWG06p1%2FPI3PxHypEBHLrohJ5YWxkc%2BkRfadtQOwh2KyGE7a7I3rCrCrTe4nYZw8ahQ85GX3blm%2BJZZuSlhu45laTxULCv9hg3OyXoXQf2BTTtRQV3Ws%2FhbJndguZoTpc7gc3f7f9yLpm3kQmP9f082Jo%2FWMtlfDJmYzTbn%2F7smPo1FxM3Nz%2Fwx8c0PEGtWAf7BgWWPM5lIeuGrWkZXNQ9VMIJ6R8lytV%2FbCZLuKvHkcrFJexCYgK1URMHadC1dAFS7VeSdG0mOINxi1MUg%2FvKXMfYWg0fT2jMDpR4biozYD4mzBzKvphHHK2%2FGifYR%2BabXmIV6ojkWDBgKNRP7EcSwTR1T5rgdPqEx%2F2NUw2xPzoQgxewyZcfUr0SXBZshH9b2H3sLF524hbqIpZ4%2FhkSU0uJE0tzt0GZ5%2FQ8AfY29l7XQVvBiMLbED3g%2BcmSnLPJOmsAU89RGKMZoElchuMfMzFD0gkyUfjGFrHIholIcoc1WuOHOQ7irTgDOI4sulSOGqiql3PmO9vclSOnLM4iAUPtlk6MtAWtW8uw5oypfmn2fM2BBLIqYw6jGS%2FcK8&s2s=1
Title: 1 Tropfen Um 21 Uhr Verbrennt Bauchfett Wie Verrückt!Ketogene Diät

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=3uNjE8s8Pyk2IKMgNqUKo%2BiskCg2BEArPsUDxWAImGSkgYTHy1pVHX5x1Zt87rOZPu39WK%2FX1KWSld%2BpOSS6Yg7vwQx93G%2F%2Fg%2Fb5LZ8PjWoYUPP8aP2pkkcnDhYkEoVqmanRe8t8zG%2Fzo1eBRe8ngI%2B0%2FNlvg35U4DFbToemvDOXLqSTnPWuAGy6wTiPa8M1nlBtsEp3cI4TpMLx4H1C8g1nQRXy4z80Vxb8VK764cu%2FcVPrl2S%2FDaXFakbm91%2BJdwEzgGhC%2B2ccpi3sN7jBeht6GeIG7BcFisKO04j4tp68EE%2FtmkuBUBFxhtshJhZJ0lqCGdCyGg6g2eJVl%2B3P9kx%2FnyjEi6i7z0DRvqB%2Fhi%2B0gEWBVlvFsY%2FjuIZ9hppNqmLnhPXtUwEFCNnEd1cRegFw%2FglKmF5AF%2F4UDuu4ePzOVdKQNeCqGZE5AVHmD4h0CxyMUoQFzl%2B7qwsBEsf30Tzt7Ll6I%2F1HuxUMUAllV5WM4s35zhJL1Fs1Xf%2BTBSY9awBpQpDSkfqAgRKB%2Bww75%2FlTdXPDU1%2B4GD%2FjlvzY0jJO9R1FacLHik15vkRSl8%2FAKqOtXFQgXT8LQqVE4ymH2aQmH9uN3YPxJJbT2nNPbjhFjUPlBima%2BMzUOoRkoCXwcsFdBsaA%2BuPzqPC7faXuF3gGYT9GmRAkthxuAQ8V66ex%2BQrUlDXJiozBXQinjsRINLxCvTxAuUFeXLqT%2FVwqhwNQgqwFVOEJP6PdjeLr8aN0DogAVQXh%2F4mjCEiDO6M9K5ZsLSRKbN3Z%2B%2B8XvFt6zSbAa%2Fz5r1uTRUslhknczxfDntPxVnifraUyEX5o4KGrbZ0MHiePKzdJaom7dYRhHjJV9TRt83vuiCyUEdpzvJm6brddCY95c9wlKDeo2dBNn0piZbxIVBhw8Y8jYHbEfOVsqtdNFzsZppARqM8F78snfX8WIHX5LZnD%2BvcwPnIWK2e6q5nON4%2BeUioOGuF8toibSgOxEu7G150THnxKbLTD4%2Bz93wmHa%2FJv%2FwERypfMrvNfnesYkJSlly4Otw%2FKTgQAqJl3SNC5pjujxWgLmF4gja2WkKAETzQKP9%2BU0aL6VT9giCGSvxMbgsfvwwRxnmwRRFOTkT4kkZ3A%2FH6iA1a1m1FKFbWGA38kMHhdxK08Y%2BbB4WqUlTrQqj2AlKgjrQE%2FRgph09UF4CYvfZKlWZUiza9dL%2BSf7tARxMwdDNWFrCY8hxHYNjCPVYojglbpSqpTNroGoI1wRsvtqhBQUBmfb2AiEbrZO0zmIzeRkZxYXIftGZvI9li%2BHoBRgEaug1M8JXs80RmKhuxmoA2uEGax6V4RhdxhpK%2FMU5rpAE%2Bg1BnmBj4g4l59a88W6HrFt%2FBEtB4U7QobHL%2Bw387sADH0ntEMeFzSalT7QeLz%2FOt97teMrugJMXEVrOI0rpqfLE63fHex4yrNmTMEVeCkCvc5Im9mjLT88HWLOxR2tmp4%2FUM0rlAMQMNOXa0ZTiKB0x3WDidg0nVYv3r0KUYwJJjJFEXIUZaMf%2F94rI7atgupNEMGbeW8yytp%2B7fdB%2F7OZPCz6uAAYUY0m%2FgtEbw%2FT%2B1LTe9kATJUmeqgQm%2F7aUpTf9DbbzafJYYU%2FCemHdRDcovILtFgM8EvIjvuQDEA7Gg%3D&s2s=1
Title: 3-6 Tropfen Um 21 Uhr,am Dritten Tag Sind Ihre Hose Nicht Mehr Für Sie Geeignet!gesundheitstipps

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=%2Bh8PiS4so%2Bx9j%2B%2FCFmDP3xMpWoVaePjJORSxuctARrrGhxWDheSnxDLB0tf9G%2BOWsVKLN71FOCtOoaVi3qdG5Aw12tC%2Bueor56Vz%2FAk6dTWNDCB9nWcDlWDrLVk9IsIy7XfIwsmZtCietrcsD%2BnNGfDXSY2ZBCp6bNzm2RZtmT6tzbHMY0mg4WZ3oITYoDwJQAHM26nG8hQzSvo7s064nyKzD%2Bp7bV6YmYFgl07RwRcncxh0ZZSDYzJ9UItOz%2B%2FWG3vkunD%2FD0Lq0VEqWvDt6u9clKtK2CU9Uag%2FJ1ahR0tv8oTDK9fx9igtKL3LeTVnhrfMjs6cfHRiAh1tHtPy5vVlHbfM7908brRYmURAUAViusjAcejIfzacy7qGQOJGtBG52yeYUr%2BltaK8ZM0nmXf1KGY%2F6V7dQCsA3x6qjtDmeQDF%2FgR6HaRR%2B5vWr5vILgNklv3QD2OShR7RVkyi%2B8WvZ%2FzoJdHAgn3drZncpHWnDqPUPf2YDOD4jU2siSxZC%2BouJ%2Bi220n07Scqub6AkaS9zcUDpRTA9y3bkRu8V6uGw8zQtXZZijrnzWWrCUlDyXsG6CairuESnlzExaV8qxAZ1YUg9lWwS11BzMsx3VGOb200G%2BAR4fG9FULt5MOAQIXo8%2BSfPLVuRlKgSLo3dI0%2FwKPSMQT9PRxYI2MVOkNonMsXF6oYttIoaJvxz8n5pJzBkrp249IarvtzN810y9vDiST85sEZJXwFCOTLuZ6HjVoxCe%2Fo5AXZNT19Z3qUAT%2BaH%2BWnDjm3G%2FDmYyt7hexY72%2FyMMqHnThra15xfwDhbvJZwgydZlQoEx6fGon%2FjzBC%2FFqX3xwfKAsdtwjgMZ57u8JpBhvzA2uyJ91Nc56AVA%2FuLVOmbe1ObaQQP5LmfLaOhW4SvKpNwP%2BGF5k2C08YHf2bG4iFLHPB13apECmZ%2BNiV4TBVok%2F3e9enyxRsKe%2BoC%2FZcH%2FNVCdzw4qudfndKELYqWR%2FF1wqpchQ3OTu%2FVxbZafRw%2BUv2GyssGrLaBNeSp3LRgB3tFqrY8ppQoRHGgTu8u4FAzk8OI6oiAburhZvGRVxx8AIo37CTcqGhpRRUxXAzcJR90Ns9yOzpJUnB0M1BrpPJerVRI%2FWBrtrjlP9HInjYrDWXNWQA3NBgzboC0WQ8KknYCjIKxYYEcHloi2YfwGKjJydPoIwVDMGiuJDndr2pZk2mgSuzfidtyNUuiMrHhxK6JgZdUz8m2lyvIh7DfsIWUVZEqw5e5tAsTErBHnpxfFRfE%2BsyU5vjlpzfXNp2OKKoMNe%2F4rejMm6%2FqaqADuB1wg7vLrrJGZnE5Ct5fA4UsjSiCq70V5p1LC8DnyR9yCrjL%2FR52wVMpInLh6QmkMQVYwXdLo6kKmrmwDspLA60Mt7QTWpTiHaHBURgm2rifsDzb7vuCKFgIhmD8n1e6wV2YZ1EQxWZq0gHA8KzW1PTP7BpEy9%2FGWhTVAwJjsY1PMmOCaoRyFUlL5kd%2FGGscvV3a6aLiGY7j10WdA0gN%2F0T9IgtJX3gxbCGNeZ%2BrQ9qUJ9iwHRVZuc6Vm2dZZcNhg8zpFv3ffycqjs%3D&s2s=1
Title: Das Uralte Geheimnis, Um über Nacht 15 Jahre Jünger Auszusehen!Hautpflege

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=AbBmB%2BvxtALCRisvkZmCWw4DpMiMa7Gm6N5pWE5wxTlHf2uLfxInctcBfEW25I12BWhyj93NsW6Yq7oLFJJjxxaX3s4S3q503gJxxtOGLGa1JRYZxjKUWjXITk%2Fr1CuCs%2BSRsdwb5Oe3FF5EthR3vYMSOCknhz85t37ww7hntH4TNEmU5V3wu%2BCaAvWJ3%2F82q1zB6KcEFU%2BVTbxR72uCuo0uzoKx69CHLyff1usc7yGAdoiEqvm8WhxyfDOyS%2FQ6PtAdaV3YeSlaJWDmdKcrWFiw3Ofauz9wsP2PzRiQhixyVQBhTqgrR95leEDlr%2FS3Lz7z7QIaTPcBNYnqVzsgtdiAWyQGKulJmbVoV28Uo7J0%2FdExMlPCmNozrRqQ1bBANDS1JAqr%2FnHBg8hFJVNITK6BK3A%2FpLGXHhUgpJIltsLRjf0%2FMpsrTbD6w61fKYYTtV9txZ19rmYkpjqwEvnCo%2FDsSt6pUt5QMGYgXCbNbNcqNIhBrL2o0MYPfZtMEVr71dSWHdPFW8OpPnWwCI2wyG5Xyw1ZX1bfaz52Ct%2BLObK5HYioc%2FL%2Fnq3UHvlbbLUa4FUQbpUqexB2RtzWs6JocJ7cHNSxNn2RKMh0XE750209UKaXCkm6ZHLk5Bo1ZIES06s130yp4N6aNkZ7%2BGkBEQXwrrnNd2pv3YJKrl%2FxiY%2BeSxeCbRFtZjFL4MsL6YPb6%2BQiN%2FwYpYtcdeP70CQKqkAq36Lo3MtkWxOkqUNOvrvUKeuXkwKDJzJtObIzshdhutKn7Ik3tnA%2BWjXmSScl9EwC0Sn97jmgfcIyJwivl1aF%2BwxwjmumrWLD0GxSha3OP4mvxs35PtdECq66OJY1kgAP5Y6vv5JT88q8XMpKvKHboKPGc%2BliKLwpxFXZPIwGBBKTlsCboC2zAYPnWvH4Kq6GKH%2Bia8aeZcPmy5lsKtpb8gnzNhFnwFRJhPU6ia4Z1EEG2VAWCISZx5ZPAx%2BwlhEWUHVYCAjoEWp1mYZLzx57EM0rl%2BzhKK%2BEhyRtP2OtpB7WexrNoHuVeHXJokvoKmk2yvjZdANcR0LslFyAGvMCscgz2uzBhdJUkbLPZlQG3l7hA7LCS2LDIZZF49MjkAxhF2ZzD%2BKVp9QGYctEUK4cRCD%2F0P68OS3xePlH1aVgR9fcg6DUfIiejMF2%2FfOtEiOpQdb8xQsGOM1%2Frw3hk0TE7V1quka0sPhBvxFodb7c%2FQY7PhBvkvUTSMwG9h2rFAS8EGWkuMb3WQkhFN6n34fBVaD2O4oWS36E0mYMeoFs1lUhwugDk7NQcHWNgqtBC6q6uNAvzOEx4ExsjzTl1dQg%2BlyjDTMQo00R8L531UIkZR6iCfYbBAoz%2FZBEMjiezd%2BceuuTnvsfX9HqFhKTAN6ZZXGzKhq452Bzlte2FbA07gqHG6uyXmMZY5VsIcyxH4SjQrmxS1%2BdN%2B7KeGp5vEHpvLAHLQVloE5xkUy%2B1dsJ%2FLSV8Jcw%2B%2FVlEoo7ehGUzHJ3q%2FvKAsMo2AkF2RMRWiIhlUijkQLCPxVx8mPqU0yzIx2tleNwQ3SUwMbPQBbUpvBDWzvKt7CO6IKCERYE7gCrs4BmcyyfilVWqLR3QC%2BW&s2s=1
Title: At 55, Marisa Tomei is Still Single and Now It Becomes Clear Whypopcornews.com

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=iVOScmHTZXTZgwmaVCVaRzfGgC9UwDXOMlLORyqbX2W9Jzad%2BDZy0oXGRLw%2BDATQBdW8%2FnGN8cYlILf6ccBnCIiKvRugCFWS613d4x9kkcDnaJPEpvU3smjqKC1WVhPDc%2FLmnkCN%2FG9wn1E%2BCi6eEyCopwfSGEP26wTsJS7ILZ4QWvPdmvBdXVn24z%2Fv8YH5Priry1im3g2LrZ2eilxwwUV1sxuwfIBbrAAJo1MBVlX6y%2BnhcsBbwF9Hxu36qpvqSYYnXdONMPbuQ%2BLJ8prfVAvTgE2NID5ouMc7k49Ls4lV8m9AStsksLOba77CC9Wz%2FWg%2BfZ85Mdb1fCu3JtoOMKAVjtaxaiYQNfyCcJJOjwBSWYdnDvR0MkvesHwVQeMmS3532Om3yvRoTN4ykFWX0QRdhr1eKfsIjDemlBW%2B%2FIKaXbQGmatttBqMl9cN4fqLEp5pjEFX5VBNKxgFzVI%2FRmtFVvDsZbmaTsy1ah%2FzKzVzAK9J130WxvvTWPUoEcSxfQBvIS1qWl8NncEcgmxvej03KYVqjJKY1uH4bnLFYYzyHsYnL7rWCEnqzbLrou131WyzU2%2FYCs98yj%2F%2FaZemwLlKj0C1PUKf5EbTvlAxgnXxk46hDT11AY8yM26vAvOeAU49WWB8qAg2zkXdmUoIgFJInY79oKErUmsgx5bNNPtLPCekT0w7Fjkz6Ij7t%2F8Jnkj0nMWSVkmztKJ%2FnED1PvRhxsCvA9%2F9ksxC%2BMHADg1r46X9fadGgyF2ansqvpQummSaTBTINFqxya0fhkKikmp0aMT1fSDSMFsVMVdW1LJk0th%2FxqtUbMuw37cJHdJYgstgJ1arNgj308G6haXInTKSnrHk%2B4VrPLs3KUPfwsTGfcuP7XoGERijxihI8V3fEvLHZ6oJN23jemQ9woxbw%2F3TY9Jg89kwMgsNGpBYfEKS3vChhY62WRyF694K7kkiC4iaRg6748z2D%2F2fKS42VDMAesqhCUaFXW3glajO6XPXVz1qFvUoSqcJQdJkgS4Fr9qzQj2%2FcvaT%2FN16QGfYdHfKwc%2BZxgf5rcmtbkWkLciFBYwp5vmQU5ttWOwia0NWhXMDTt4hm1pfwBR9FSHm3qqpvIlfuYKHkOVHxDV7nMcp8fT5QE4Ub%2F0qrizErZeDj3a61UJ8WwNcqYhn%2FIsYT%2BDvA9s1HDEQT0zBnkfWI4xGw3J5gM0izLf5zYsGBSeQbX8%2Bhvq3AXWdJ80wuXozL%2FtlK85W4H7peiESFRnTVzQRHfdUiMp86vPm%2BQ0Hegzk7IIaP%2BKPAYMx%2FesEdca6IUsaG7E9eRkiNCG7uypZZmr3rHrC0HQ30IWpjn%2B9Krv3xRZtRUTWvb%2FQGo%2BZ22L63%2FP4PNC6XAvspEJnAxMMthh9zlmEz1uu4xohMFJlv4qK3sM3W5D5Hl6j%2BBHBygIGT2EEYAss6lnj92GP9i0S1en1XE2UcS8oTE9CbYXmSa66ud2YeFo0bHK4qBtNaSSWvo%2BWixRLpn4lmci4uLOSLi3E6Q0jBomu1sPhWJvcmdh8hcEiyPxWHjqdzuvKGpb7Qd4SkTTZHeYTuQMIKDkOfNQ%3D&s2s=1
Title: Diese 2 Produkte Töten Ihr Bauchfett über Nacht!Diät Insider

Search URL Search Domain Scan URL

URL: https://trends.revcontent.com/click.php?d=%2BvBi7Sqltj3tPUkC4PtXKzy7L5d57esM3vd%2F6R6WNT0%2Bs8uWPh%2FvnJ%2FYX9JudqeESiZrBRCYTxE3PZoGn6eZE7NPB8cdGXj62eq6fdrHuEzDqdukL0%2FHAbCOwUrCvBv1R3cu8x3sUoQ%2B0kFT3%2FxpnxPmRFnRl1jJRyuf%2FSnjb2HUuqFUflGlMOza4dnDfMyw5z%2Fz1gk4%2Bg4yYqHlwNqq1nRVgxz8s91pwE2bO7vsVVYnmYgZGLiYIr4Aehy3PN%2B5tlY%2FlibTn6L0py6tT6HxLPuNOZONJNBYlcxezDnAzPzo4suzaSzmvqfO34yLwTsJ76fsTbxyLs0OcskBGsFbqluieCYPN8z9T7PeulHkkt3zADatzJ3VC%2BMz7Jyq8XK6L9FB2y1pd3HSYuesaW3HYoKV2VPsILZy0wzEgl00TRRjlJ%2BHDl5XbQAjO%2BtSAZpLCMIhFrnPMf%2FT%2F8fHZrXXtoBA3xxNpBSC6PCQbnGLAAA%2B5dXvY31YklGj7T1S8iUJqYDZEG4kyZBwudT5TEpIs05bLrJy9HFN%2FkMnp8028aDilHXFZ%2BY%2Bljy8T45TnPBr9jvzCCFbSS1ZgYP3vBYrh3wbeldcWMXxPoReeETLfIci3CE0%2BeU3F1suMOBfwA%2FbUaZp8SBig4kC4Ncjh3smrzMW47m4zulMZ4b%2BfTeZbo2dM13wcScHQthWYJ4m9S43NAq52HRlLqeGvl5%2BqUUobkS2BGTrc8u5NZIm5vvrCssFLKQPzt1nm%2ByLrFvvk1BvarHldCf%2BqyswvGdvNE22cIqXmJ6uXbFUo6Aq5oaIKtCV%2BYety7OsTo%2FQyUuruFn6qRRMdSugKk%2FducNALAp9y%2Fc5JtC6U8MCREWtfbUeHcfRXwYapYKrXHLxirMYxEJO84XM59uDXkt5uisz4RufzUFx4DoDy2KnU%2BdVpCzsUX6p9e9DlEQ8%2B43SZ31IkE%2B95Dn%2FzYeh239gcgNtMAJHtp33YPuysvaj185o6m7L0Mm1oRnvV6PyaNLrj6%2FYBMdvQZYnNo9PqDzJfuYVSgRsHUabLfbSn2KvN%2FDduWVgtOk7sXHxmVq9tjCXL84IUZfqSyS0iMWZnOrVUyxh3pa8jyKpTpKp2Eus3bxSHPJlN4EcYekzWWxZCLKbl4QLJ1KM4T1YeOGMqoZ2kYNLf%2F4wXK6fs%2BmVGr0EyJ0NL1csxJhLIF6aMtBCP0sThcidNJnGsFVVeDEkhiNVpuoCoGiMhjpMqT5IIV7wRCBfW6yXt7jIQSGI8Mnne4a5GwSUO3FMnX1lLRkfEym5wVTZs6PSKMkRcft9mrNqbvWtVozUFHfU2O3FGstgDTidlo43hF39d86uQTIy7Y%2B%2B%2FKrnUPEo3iFKb%2B7I0vnBRotdJlYzHuBpAn63YbLFonhgjUYh5rTOPXSxlRrzNI%2Fp9iPNaFfxKoRNHL1CbnnrVLpUp3Saxh9CV%2B0lRCGNBV5SBhc%2BaZbmxZ9tcbg6PCR9PkGaR%2B7odAzzdRcabB3Nev8ocgWE2LzCWUUYkg%2FUpBXGQ34wMXNdhk%2BKVDMcgD5RW3OiCbXetiaCMgjU%2FwdtolZZNlYVSmllnBA8lksCHOij5qL8wc95sfbjZOuz5gce2cuHGB8m%2B8HFaX14NkROg6DSrk31PCczmDdUTNmOy9JuGPtyvrCNjsCcMuV5IPk21bDLQv2nsA%3D%3D&s2s=1
Title: Secret to Rebuild Your Gums and Teeth and Get Rid of Tooth DecayProDentim

Search URL Search Domain Scan URL

URL: https://help.revcontent.com/en/knowledge/revcontent-privacy-policy
Title: Revcontent's Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.revcontent.com/popup?utm_source=ads&utm_medium=organic&utm_term=signup
Title: Increase Your Engagement Now!

Search URL Search Domain Scan URL

URL: https://help.revcontent.com/en/knowledge/fake-news-complaints
Title: Submit a Report

Search URL Search Domain Scan URL

URL: http://brazil/
Title: Gardenia Marques

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=NkyaIliuO0s
Title: https://www.youtube.com/watch?v=NkyaIliuO0s

Search URL Search Domain Scan URL

URL: http://celular/
Title: Marcel da cruz

Search URL Search Domain Scan URL

URL: http://brasil/
Title: Fábio Xavier

Search URL Search Domain Scan URL

URL: https://choiceclips.whatfinger.com/widgets/wWidget.php?utm_source=&utm_medium=73cdf2a50c&client=73cdf2a50c&post=126862

Search URL Search Domain Scan URL

URL: https://choiceclips.whatfinger.com/widgets/wWidget.php?utm_source=&utm_medium=73cdf2a50c&client=73cdf2a50c&post=126838

Search URL Search Domain Scan URL

URL: https://choiceclips.whatfinger.com/widgets/wWidget.php?utm_source=&utm_medium=73cdf2a50c&client=73cdf2a50c&post=126835

Search URL Search Domain Scan URL

URL: https://www.whatfinger.com/?utm_source=&utm_medium=73cdf2a50c&client=73cdf2a50c

Search URL Search Domain Scan URL

URL: https://www.georgiarecord.com/cdmedias-historic-and-revolutionary-newspapers/
Title: CDMEDIA’S HISTORIC AND REVOLUTIONARY NEWSPAPERS

Search URL Search Domain Scan URL

URL: https://gab.com/home
Title: Gab

Search URL Search Domain Scan URL

URL: https://www.bitchute.com/channel/OwzSx7PgcvTk/
Title: Bitchute

Search URL Search Domain Scan URL

URL: https://commerce.coinbase.com/checkout/18e84dce-7828-4caf-99f3-eaddc211fb6a
Title: Donate With Crypto

Search URL Search Domain Scan URL

URL: http://clicky.com/101335412

Search URL Search Domain Scan URL

URL: https://my.creativedestructionmedia.com/user/

Search URL Search Domain Scan URL

URL: https://my.creativedestructionmedia.com/action/public/vo/logout
Title: Sign Out

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.ly/clnews-cdmedia HTTP 301
https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://www.instagram.com/embed.js HTTP 302
https://www.instagram.com/static/bundles/es6/EmbedSDK.js/ab12745d93c5.js

Request Chain 173

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreativedestructionmedia.com%2F&domain=creativedestructionmedia.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=Whv-0HxPSllzUEdpRTU1eEJhUmRTTmVLbm9BSU83Zk9XaW9oeTlpY1A3WG5ZL1JXMUVFQTA0bUYzMTlTc2MyVFVXaWdCNkRLc1JIRCtQUVJFQ0w2RmtabzNvN29DbitWQ3dvQVAxVGFHa0EvNTh6L0c1RjFZUmdCampDbHU2amNzY09aRjArNkhCeWpJSUtEcVlEQmxleUczTWFvYXI2d2hCUk40UjlEUjh0YmgvQmhhdE5TTmJQWFpqMlhGRW50Z0piNTRxSktBZ1FWVWtlTUg0TDN0OW1WaFh4dDJzbFRmOWJhdFF0UGd3Vlo5TVFQZWtNNGovaCtKeTF2amFxR0pMMTg0fA&cppv=2

Request Chain 180

https://ib.adnxs.com/getuid?https://ib.adnxs.com/getuidj HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fib.adnxs.com%2Fgetuidj HTTP 302
https://ib.adnxs.com/getuidj

Request Chain 181

https://eb2.3lift.com/getuid?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D76%26uid%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D76%26uid%3D%24UID HTTP 302
https://s.0cf.io/

Request Chain 187

https://ssum.casalemedia.com/usermatchredir?s=184932&cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D74%26uid%3D HTTP 302
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D74%26uid%3D&s=184932&C=1 HTTP 302
https://s.0cf.io/

Request Chain 191

https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=0&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D22%26uid%3D%5BRX_UUID%5D HTTP 302
https://sync.1rx.io/usersync2/rmphb?zcc=1&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D22%26uid%3D%5BRX_UUID%5D&cb=1672155579039 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=470582723

Request Chain 192

https://ups.analytics.yahoo.com/ups/58448/occ?uid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e77%26uid%3D HTTP 302
https://ups.analytics.yahoo.com/ups/58448/occ?uid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e77%26uid%3D&verify=true HTTP 302
https://s.0cf.io/

Request Chain 193

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=0&cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D81%26uid%3D HTTP 302
https://s.0cf.io/

Request Chain 194

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fs.0cf.io%2Fps%2F%3Fps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D84%26uid%3D%24%7BUSER_TOKEN%7D HTTP 302
https://s.0cf.io/ps/?ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=84&uid=

Request Chain 197

https://image8.pubmatic.com/AdServer/ImgSync?p=162168&gdpr=0&gdpr_consent=0&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D162168%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fs.0cf.io%252F%2523ps%253Dtrue%2526id%253D20%2526uid%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=162168&gdpr=0&gdpr_consent=0&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D162168%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fs.0cf.io%252F%2523ps%253Dtrue%2526id%253D20%2526uid%253D%2523PMUID&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QTc4ODZBRUQtMTUzMS00N0UxLThBNkQtOTFENzEyQzIzQzA1&gdpr=0&gdpr_consent=0 HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=0 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=0 HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=162168&pmc=1&pr=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26id%3D20%26uid%3DA7886AED-1531-47E1-8A6D-91D712C23C05 HTTP 302
https://s.0cf.io/

Request Chain 198

https://bh.contextweb.com/rtset?pid=561205&ev=1&rurl=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D21%26uid%3D%25%25VGUID%25%25 HTTP 302
https://s.0cf.io/

Request Chain 200

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=0&us_privacy=0&redirectUri=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D82%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://s.0cf.io/

Request Chain 201

https://cm.g.doubleclick.net/pixel?google_cm&google_nid=datablocks_inc&google_hm=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm=&google_nid=datablocks_inc&google_hm=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&google_tc= HTTP 302
https://s.0cf.io/ps/?dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e

Request Chain 202

https://sync.mathtag.com/sync/img?mt_exid=75&gdpr=0&gdpr_consent=0&us_privacy=0&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D61%26uid%3D%5BMM_UUID%5D HTTP 302
https://s.0cf.io/

Request Chain 204

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 302
https://usersync.gumgum.com/usersync?b=apn&i=2706312133842823575

Request Chain 205

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy= HTTP 302
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=ccfe6910-32a4-4785-be4e-49a7bc50c305 HTTP 302
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=gumgum2&expires=10&bsw_param=ccfe6910-32a4-4785-be4e-49a7bc50c305 HTTP 302
https://usersync.gumgum.com/usersync?b=bsw&i=ccfe6910-32a4-4785-be4e-49a7bc50c305

Request Chain 206

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=0 HTTP 302
https://usersync.gumgum.com/usersync?b=sta&i=0-2106e0f6-d961-47b9-7961-337a764edcd6$ip$80.255.7.102

Request Chain 207

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
https://usersync.gumgum.com/usersync?b=zem&i=&gdpr=0&gdpr_consent=0

Request Chain 208

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=0&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5297189373

Request Chain 209

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
https://usersync.gumgum.com/usersync?b=pln&i=3xJzAV2mcjqh&ev=1&pid=558355

Request Chain 210

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=0&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28VEP5SRICO_3iMQaliVsQ579nsZ4e0Oa1bL2xYraD_8bDhWT_cvk6gO1RDkSODdgs%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28VEP5SRICO_3iMQaliVsQ579nsZ4e0Oa1bL2xYraD_8bDhWT_cvk6gO1RDkSODdgs%29 HTTP 302
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&obuid=ENC(VEP5SRICO_3iMQaliVsQ579nsZ4e0Oa1bL2xYraD_8bDhWT_cvk6gO1RDkSODdgs) HTTP 302
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

Request Chain 211

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=0&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=0&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=opx&i=c611ef8a-f88e-48df-8ed0-6b76163a5d3f&gdpr=0&gdpr_consent=0

Request Chain 213

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=0&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=vnt&i=5a0a9403-5480-4719-ab8d-6a942d30e32b

Request Chain 216

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D

Request Chain 217

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=0 HTTP 302
https://usersync.gumgum.com/usersync?b=sad&i=133130337172360044

Request Chain 221

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=0&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
https://usersync.gumgum.com/usersync?b=mmh&i=bacf63ab-11bb-4300-ae0b-cfc904cec643&gdpr=0&gdpr_consent=0

Request Chain 222

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=0 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo HTTP 302
https://usersync.gumgum.com/usersync?b=atm&i=Y6sRuwAHKo4KpwAo&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo

Request Chain 224

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=0 HTTP 302
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY29tL3VzZXJzeW5jP2I9ZW14Jmk9JEVNWFVJRA== HTTP 302
https://cs.emxdgt.com/umcheck?apnxid=2706312133842823575&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY29tL3VzZXJzeW5jP2I9ZW14Jmk9JEVNWFVJRA== HTTP 302
https://usersync.gumgum.com/usersync?b=emx&i=2706312133842823575brt50851672155579284796f1

Request Chain 227

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D HTTP 302
https://usersync.gumgum.com/usersync?b=iex&i=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115

Request Chain 228

https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
https://usersync.gumgum.com/usersync?b=rth&i=iZmCIAvYAtdwjxXZ7wXh&pi=gumgum&tc=1

Request Chain 229

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
https://eus.rubiconproject.com/usync.html?p=gumgum

Request Chain 232

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:56a563ab-11bb-4500-8f28-67cccb48fd5a&gdpr=0&gdpr_consent=

Request Chain 233

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7218457549909024635

Request Chain 235

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent=&dcc=t

Request Chain 236

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2706312133842823575&gdpr=0&gdpr_consent=

Request Chain 237

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=0DDzKNcy8CjLO_Z_gjq_KIM1p37LMqt5hDL8LytP

Request Chain 239

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=p4hq7RUxR-GKbZHXEsI8BQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 242

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=3146363876 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0 HTTP 302
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=A7886AED-1531-47E1-8A6D-91D712C23C05

Request Chain 243

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO0InM6rPeoNSEzUlqBWHl8&google_cver=1

Request Chain 246

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=3701215670987294756

251 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Redirect Chain

http://bit.ly/clnews-cdmedia
https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were...

378 KB
67 KB

1440ms
1343ms

Document
text/html

2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58cef6c7011c8e3051862bbd48a0cb18418d6f40812deaeb03246fb5e1c245f2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7803263f18b29a2d-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Dec 2022 15:39:32 GMT
link: <https://creativedestructionmedia.com/wp-json/>; rel="https://api.w.org/", <https://creativedestructionmedia.com/wp-json/wp/v2/posts/53173>; rel="alternate"; type="application/json", <https://cdm.press/1Q2>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PV7qSvU5LMf2T8KiFKiKBLgAvfmmdu7XnGGjN9WELBlCgMUD4gMtHgOnA4U6G7%2FPOR5BmpmVNmBkait9O6%2BpN0%2BNTDewyTWKsxweDhnX%2FJQkgXpADNvsEn%2BrrdmKu1hiUUnDWZLkRqNdSd8jR%2FMW5DdbfZIBG%2FQveUmC"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Cache-Control: private, max-age=90
Content-Length: 292
Content-Type: text/html; charset=utf-8
Date: Tue, 27 Dec 2022 15:39:30 GMT
Location: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Server: nginx
Via: 1.1 google

GET
H2 200 wp-emoji-release.min.js Show response
creativedestructionmedia.com/wp-includes/js/ 18 KB
5 KB 56ms
54ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 893
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2BD6ya8IPBuGyQKsJNoYoUvurEBPQqcKWp1A1XPSTlEhfH2ON0nXofV49yW%2FNsPOxecq8frkovbo%2BrvNBkCWZNgot1AhhZn6DykuO7NbIq2RH4a3GfFXsAxporN1QHzKLXtMe8g8K2F%2FeeMyep5R8ZGnWWPRghkefrC%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78032648493b9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.min.css
creativedestructionmedia.com/wp-includes/css/dist/block-library/ 87 KB
12 KB 62ms
60ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z6Uzbl%2F2XRgADWyKEmOk04YdrxQ0YqTh8WCFRP8xkTOP5xYmZnqusSCyqziKxuJ8cFlm0w%2BFp9M1TiS%2BOotogWIwxDk2vDY0A4qYQcPJwiIjigMgNZrDwU3fUoDJjSmOyjtpGW47UGT6788vnwtQa2LYXqkNJ3vSmglK"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78032648493c9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 single-shortcode.css
creativedestructionmedia.com/wp-content/plugins/penci-framework/assets/css/ 27 KB
4 KB 97ms
94ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/penci-framework/assets/css/single-shortcode.css?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71d67862610b80dc5c9a9ceb03f4bf2e2e6305b17e490a32fec5139c40b00ba1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 09 Dec 2021 00:13:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O7KauGVUhQ7xYEYpwWXf24wVdFLo7QHMpdHP7bt1T4NNcPepOoR%2F2xY9HyphvvIhDe6LatRPuV21369BhT%2B%2FTxCXREYSRdi1jHoqiZpo56dYijfaCcdOPEH6xarMW26IfKmDgvKUucN8tGFkr%2BiDE5V%2FI41cN%2B3Ao5an"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7803264849499a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 secondline-psb-styles.css
creativedestructionmedia.com/wp-content/plugins/podcast-subscribe-buttons/assets/css/ 6 KB
3 KB 52ms
49ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/podcast-subscribe-buttons/assets/css/secondline-psb-styles.css?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de9954490715ce618665188122b2c8a18e92e417180c514429e7129ae967ff99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 16 Oct 2022 21:53:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eS7D6dNXr0FvpvaRVITetzVSeHl9RmheKSDI6p12D43MSYabQ%2Fql%2BFiIGLgbZ9QMmUBH8N%2FIz%2FUDpTexKIoX8C9HpPa6yLJxO%2F2GjxBW2lj%2FWq3WsiU%2Ft68Yj0o2hZ1rII6wTlee8%2FCX2Yh7OaImbDdD5Ed4aGwuB0pR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78032648494d9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 theme.css
creativedestructionmedia.com/wp-content/plugins/popup-builder/public/css/ 70 KB
11 KB 56ms
54ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/popup-builder/public/css/theme.css?ver=4.1.12
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96344c48276b6477946734dfa6f60c187fa33d371c0f4bc2156edc0e2868617c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jzp4XwK5SbfxsEF8FzXxUdKasuUQ%2B3RULwTcTulVAjOHANkc4d4U%2Bvt0p3RAK7Dbs3TvQPWrgLM5EbPGW3sL13%2BM94p9uLAld5y8ZYmWJuUFgmsqAahsoOam6UGWoP3FS7xuUi%2Fevav20fq0DuOld0Rmta6EacCMhFrk"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78032648494f9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 frontend.min.css
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/css/ 97 KB
15 KB 90ms
88ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css?ver=4.0.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19395a31eba590812aa5b60221b9ae0f2afff2a89bffcd05efdb5e0001a4bf8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rTSSMXI635F7XYC%2B4iVHLNFq5HV3vPoKamVa0Yi5dNC40W6iX%2BkKmW%2BScXHxJ1YEAvrHABUEgOdSioSEO6UlfDJfJo3Dxn2frrt5IZAZ%2B5Kt%2FKNeW9Fdhipd9VGcpABU64Ro0YEM0RwPQggSOkJxVbABo%2F6kAztZqK5h"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7803264849529a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 flatpickr.min.css
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 14 KB
3 KB 52ms
50ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css?ver=4.0.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SRddMOIg%2FGTXnXiYKTEoTo7ZBPz4%2BXy%2BV%2BnZWiSQTdq1KuAlBQ2oVvHz4hBDu1TpnT1nVhJDCSPqS8jbjCZSj5WYStVR0iasNSzZE%2FAppsrqOlG6CSz%2Fwh0rquelFM00YtXH5LKt%2F%2Fmac0B6r7bKOIWicYFh8lmpVM%2FD"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7803264849549a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 select2.min.css
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/select2/ 15 KB
2 KB 64ms
62ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZD7L%2Fyag2f7ctzN%2BPZzfcy5ki5EmQkiojgvzRbHfcgNT0eYLrbOjal1CQpkaDHMsZ2degIR47wu2cK01M3V4V23LL94onmOyM%2FDF28m1OryfrjAdLWkuFHecwa2Mk8Ss%2F1tYxVf3FcNxIeWh1g1LVNVsAzVjF6deQuT5"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7803264849589a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 font-awesome.min.css
creativedestructionmedia.com/wp-content/themes/pennews/css/ 33 KB
8 KB 87ms
86ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca6507f8b18edebcff32e0e69a3012b3e20ca7bb5f0ed4d5ff73b147654c7c86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 16 Mar 2021 04:00:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8pvmjY786F53OH3UxT%2BWWOdgs%2FCmxXNsE7A2YY%2FIOuRHcetPYHatWlDCzWuN%2FNEq0J3QziFnwYG%2FuqHxMZNk%2BpRU8GNIdX5H2Gurp1G2WeHREr1Je6ooUdawkNIvgqNtOyNi1fFRzOU3tWiKFj5W6X7ru46KnGyOX06s"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78032648495a9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 71 KB
3 KB 134ms
50ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CMukta+Vaani%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7COswald%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CTeko%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CUltra%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CVollkorn%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7COpen+Sans%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%26subset%3Dcyrillic%2Ccyrillic-ext%2Cgreek%2Cgreek-ext%2Clatin-ext

Requested by

Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7163559d8b2983cff10f0b2e0317bf000fd5ed1dd17984673ff43e32ba49d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Dec 2022 15:39:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Dec 2022 15:39:32 GMT

GET
H2 200 portfolio.css
creativedestructionmedia.com/wp-content/themes/pennews/css/ 22 KB
4 KB 57ms
56ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/css/portfolio.css?ver=6.6.1
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 487ef2c201c33553c12eb0d7b9360be8e16ee7770aa7b9b42368e4a442df53fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 05 Aug 2019 18:12:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=adayvCT37yqOTsEmq7F%2F7KYfxlpWUSPtAMc0sMgS4Eil%2Bq%2FLIKmGKJafw9vQZNCUDxOnSiy8Gx4o8q0gNp84Fbcwaz6ayLn4esRKC5cCdeg5HmSgrjBzu8%2BUY757cYFFb9Ad7mHRRmQ7vLNI5rtFXGFWS8czqFH2groT"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78032648495c9a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
creativedestructionmedia.com/wp-content/themes/pennews/ 1 MB
110 KB 96ms
95ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/style.css?ver=6.6.1
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8d6468c892237d8824bd50466e7b187ea465f0d606412546423543e44d57c1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Dec 2021 17:14:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2Bhu3IxQDlqBk3lYHaPXHx2BzxjqGR%2Fsc1wVh0SXrxBGZ8oLZvkwvmCau1%2FB8t2d1pbiq7GlB0v7%2B85nbYj8q2uIikBJo0QPuziUHSSbmevZvv0GnNnVmgociQgPKHLZoWM85%2BsvSxo0ga4M0wXlb0dxRQ42yf8FpnD1"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7803264879b69a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 style.css
creativedestructionmedia.com/wp-content/plugins/newsletter/ 6 KB
2 KB 48ms
47ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/newsletter/style.css?ver=7.5.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff7cbd7d791c0f01f1b7db211981bb0506701f663e9e41422586b9e625753ba3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TE98Hdi9qOb%2Fi3VaK73re%2F%2F%2BE57gvhFJAg4tfEXrTC8sNe2%2FzU3w3Li3nZRaL0O3mDffS1OQLdtBbU4jyxA4grbjckjX99LudUepaoqzkLgrbV%2FnDlfutvDsfJcMfpuzvwjZxvGyWYQMZ0gPa5cI%2Bz7fEiqml59ZtTBe"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 780326491f85996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 leads.css
creativedestructionmedia.com/wp-content/plugins/newsletter-leads/css/ 7 KB
2 KB 92ms
88ms Stylesheet
text/css 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/newsletter-leads/css/leads.css?ver=1.2.8
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36b7d8525458210a8609ab58084128d933c83c45d08ed703b76f4a7c6355655b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1rPzAFnFQg1RGlXxTDEG47kLW4EBTs7ojH0az4DIYNfdiDi7JIiCUtLHEpss91RGJNIRqcMLyZNAVJGhpFPh1fh6hK9a1xb1hgFOtV4KGZPPGhxFe6Ldn6pgN0M%2BSybbEGBzX5bFooSdXZ%2B56I0yAS5DgKuEuVVch5Xv"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 780326492f8d996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
creativedestructionmedia.com/wp-includes/js/jquery/ 87 KB
32 KB 127ms
123ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 13 Aug 2021 12:41:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HcVC4%2BXiSNsN%2BViiQc4eHC0Qpqh%2Fz0iap7tauNYA4N4MBRhBLh6y5hrKtvXNdNvgxaoDMFUlzh%2BPnkT7i0QNebAH%2B6SSRnMc16rLp00QAnFPFNxOh6ON1GZSAiYKiIN2nFYHVJPVWJrfRbS9jMRQ%2FjJ9Y4Oi4WZZFuWb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f90996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery-migrate.min.js Show response
creativedestructionmedia.com/wp-includes/js/jquery/ 11 KB
5 KB 51ms
47ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 19 Nov 2020 20:01:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zeUfyewYGk5kHRGb6N7EHDJaAfq%2B7B0Untfm0rPfyNQUvUPrZegsSLQmKOi5xbogE%2B4kM%2FQ6z50rlMnV8nJCFCU6nYDKZXJ0RdkRJrPIJhFuvFXkHPnVPIOVsDX4uGvAS0y9yaMfGaZ59snNsGiFJ7ofk%2F3uQPnKhrem"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f94996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 Popup.js Show response
creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/ 38 KB
9 KB 53ms
49ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/Popup.js?ver=4.1.12
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d59372b6612612e1f165c140beb8e541b9becfa771862e2d61376252a2ba91f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XpqpBGRz%2FZHuInA0Hd6c3AFu08i0xqqVH11etzEeLcwqRaw6%2BRYX6OdOydM%2FljYxbh7ba98EI5KLPjS75kpmb8TMofj88Waq3W7SedqyEbig3jhLfwdSnjMnY07BVfhnKH0D1qjEdoe1JFJq%2FxREr8DzUv4hrIhgV6HI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f98996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 PopupConfig.js Show response
creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/ 6 KB
2 KB 51ms
48ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/PopupConfig.js?ver=4.1.12
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fe8c79d67b21039a5d059ef40761950fb76e1d17933d61509f7eb3c68f5aeeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fjUJnLdzOW8Sk1mNhDMi%2Fq86UF9HrQeUgXfntCIWK2jlc2i85zM3H7HHzXPiwhQhZ%2BSgX1jJRYjXrszbZ131a0NVDocTms4d%2BFInQMuUTYyHHCBoENfZFNUOpvIHLDceGkXqwTFceIsVkLJ6YoOy7vXdZaP23euRuO8m"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f99996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 PopupBuilder.js Show response
creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/ 77 KB
17 KB 126ms
123ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/popup-builder/public/js/PopupBuilder.js?ver=4.1.12
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ae1b9f867c5a14924d3d6b09e57f7451a00917838dd127af0782a07551e3d58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZteX7nL3vq6Gcw1ll1pqRMirYQ1yPIZThWbY%2Fn64kCqnveM1rxUe9QSz%2BHNLBbeUVKG5L5MAQbxvuKS48vmonCGsV2Pqh1i5SwTHrRhur0lFFYygL1yFoFtTdPlgqFVzXIerOrD3HtuITlmcgsa%2BenVDEJi6VylSRyK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f9a996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 ExitIntent.js Show response
creativedestructionmedia.com/wp-content/plugins/popupbuilder-exit-intent/public/javascript/ 7 KB
2 KB 160ms
157ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/popupbuilder-exit-intent/public/javascript/ExitIntent.js?ver=4.1.12
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a886b68ae530d4cc0fce59dcffb19554d695b868aa09014493b8fd1fb7425dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 21 Feb 2021 19:06:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZyHDY3XEcjwLh7QJnArmaYUN2b42Vc9zXM%2Fx5wRDIgxYY7j4Ria42b1tTM7o%2B1Q6MWZSH0daySbiu%2BvQ60LZ3H1NsLzZXbyaqnLbIyuD6M14X9FgTL2HRUKD5%2BixFvJ0GozZsKo5Yt3W0DDomHcPfQzhqus5LYzbD9%2Ba"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f9d996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 flatpickr.min.js Show response
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 49 KB
15 KB 87ms
84ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c2230e1348d437f591bf23a319992999e4869ab9aef142861ae206b05ec1be4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ObZI9Qaxk9qZyQaBP6awdJnMUboCRaVDuqHQYJOHG34En7fZSdMCu7xFXd0KHDSK9ZxkOBukN1qnTPnmbzb1K5KGTNEozi3CVltxw15Q0SxzjMGlcX788n3BOd%2B7LeH%2FIxSbfX1qdn4Hah2xO6JMRoRfuUQ0bYjl8GDX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f9e996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 select2.min.js Show response
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/select2/ 69 KB
20 KB 118ms
115ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=htE6ZabuSIqblS0lqpIrzZPlx8H%2B9IWsEcbLe8VjM8hskbmzhWzON2gjZTFWwKqd79fBrA8XiSUzOgFsueHga8JIV8LT84Vo0iuDejZFbR4LLNgn96%2FYMX1YV89AQzQx3AxD7waAo0jOUWhP%2F1su5H97IQhT9QI9aw1n"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 780326492f9f996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
js.stripe.com/v3/ 409 KB
99 KB 150ms
48ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

0a4bc5b9e39156f467df7ab86787cb30f72d4a001da60d8eaa6f3c01f926f019

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 27 Dec 2022 15:39:32 GMT
via: 1.1 varnish
age: 37
x-cache: HIT
content-length: 100533
x-request-id: cc306539-e010-46e3-9f79-d28abb466881
x-served-by: cache-hhn-etou8220097-HHN
last-modified: Fri, 23 Dec 2022 21:23:41 GMT
server: Fastly
etag: "9e5ef9a80f3ac462068b600d5f5c5cd5"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 28

GET
H2 200 affiliate_app_confirm.php Show response
classic.avantlink.com/ 0
0 393ms
122ms Script
text/html 3.217.212.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://classic.avantlink.com/affiliate_app_confirm.php?mode=js&authResponse=31a9d7e06c426323b2898f2f6a79b2ae3463fe58
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.217.212.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-212-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

GET
H2 200 pigeon.js Show response
my.creativedestructionmedia.com/c/assets/ 67 KB
22 KB 71ms
59ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://my.creativedestructionmedia.com/c/assets/pigeon.js
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a267fc94858598e6633bb6d17cc72d1410ced16aa93638ff30e63cde05045e6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 20 Dec 2022 21:10:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 450263
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDlntN4MD1ZzOX3PwrH3RCDnVcwAuEAoq%2FpPGf2OF9ek9uUtRqcsY0tTxU5n%2B4IKDfIrYAmX4BuMMrE2YaCbLxb08vw8ml%2BqVir%2Blo8oSggiC95Pim9Wg4BECu5av2jWPGDLj8%2BeF8ZgJ5eHFLYvi3s2DEvimlv66Ns7ekBL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 780326493ae59a2d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 29 Dec 2022 10:35:09 GMT

GET
H3 200 email-decode.min.js Show response
creativedestructionmedia.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 85ms
84ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://creativedestructionmedia.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 20 Dec 2022 16:36:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63a1e484-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9X2%2BRqALwclspk%2FnaWhbBkCs92axX410%2F9QTy4mKAb6DdQIhS4JycdW6GBgS%2FhF3cJoChVUyaYAghNNBAiXK9Cb0B3cBOLZ7EAC8xG5GclENDjIlKE%2BFcax0WVlCaR2vaojxeVkuS55x2ycBgV7pBPUtTXJ4CZIIbbk6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 78032649988d996f-FRA
expires: Thu, 29 Dec 2022 15:39:32 GMT

GET
H3 200 Color-209x45.png
creativedestructionmedia.com/wp-content/uploads/2019/02/ 9 KB
9 KB 46ms
45ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2019/02/Color-209x45.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f407a07bbc292cdf43c203945bfa640c114c28a0ff126611a134180e17617e5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:32 GMT
cf-cache-status: HIT
last-modified: Sat, 09 Feb 2019 14:52:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3500
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pWi1vZh37HP%2BrwoG%2B6LfBVK9nzbF%2B5191qpMdouN52PTUtId2YP%2BnsVSlClKoKbujwY%2F4YhIoJB%2BMgLrMWzhtOZjIeFNBTjzGUlbbVaRcq9nZxf%2BS1UOVj49pWCbyF9svWHWR2Z4FaDaYr%2F3zznbW64EnPc6tkv5MWKi"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264a8a07996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8809

GET
H3

200

ab12745d93c5.js Show response
www.instagram.com/static/bundles/es6/EmbedSDK.js/
Redirect Chain

https://www.instagram.com/embed.js
https://www.instagram.com/static/bundles/es6/EmbedSDK.js/ab12745d93c5.js

15 KB
5 KB

79ms
38ms

Script
text/javascript

2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedSDK.js/ab12745d93c5.js
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 2a04fa46b4ebc4bb2c93126695f45b0acf711870e1f169bb95247592c28c24a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 21:38:03 GMT
content-encoding: br
etag: "ab12745d93c5"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 4843
priority: u=3,i

Redirect headers

date: Tue, 27 Dec 2022 15:39:33 GMT
x-fb-trip-id: 1679558926
x-ig-origin-region: cln
content-type: text/html; charset=utf-8
location: https://www.instagram.com/static/bundles/es6/EmbedSDK.js/ab12745d93c5.js
cache-control: max-age=21600
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 t-150x150.jpeg
creativedestructionmedia.com/wp-content/uploads/2021/01/ 7 KB
8 KB 59ms
56ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2021/01/t-150x150.jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 048057ad539a913ae9bfe366a6d270cec09c3ba03e771386dc8231c3442471f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Jan 2021 14:00:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3500
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s2FwVo24vy0cww6vPCUfDPrkozRoMUh9LJeJEBrkmZMTi1YkOIw9TOg9QdiZuaJAbqoQYq%2BIL9d3C0cSSnrIwPIAzctBDS4SCPwHGz24iHcxFddHZmq0sDkHbnwSYnGuun1FAi%2BXY%2Fl1T%2Bt6KNxPIMHYzZ0eXrBKVHeI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264babc1996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7406

GET
H2 200 aznew-wfw.js Show response
choiceclips.whatfinger.com/widgets/ 6 KB
2 KB 145ms
37ms Script
application/javascript 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://choiceclips.whatfinger.com/widgets/aznew-wfw.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

d4eaec858474f17cfe2930fc1de5994621679c350b330a66fb7f420aadaf81c1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: gzip
x-sucuri-cache: HIT
content-length: 1661
x-xss-protection: 1; mode=block
last-modified: Wed, 16 Feb 2022 22:17:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
x-sucuri-id: 15019
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Icon-512x512-50x50.jpg
creativedestructionmedia.com/wp-content/uploads/2019/02/ 2 KB
2 KB 55ms
52ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2019/02/Icon-512x512-50x50.jpg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 348526eb2bc1407316f8c681d30513df971b67b83fb57cdcd32c4e461ea56d49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sun, 10 Feb 2019 15:48:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3500
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3su0se5n2RLCjeByrml%2FtMMTv82kdzshOV0MbrWwP7bAplJQBrtFvTx4zNV2hR3Pkzb8brIN3q6qc5P3682KwlNkyNfQMgwwX7pdf7vmqxIYFzIHzZKTc9nKNqxesj%2B9TeD3R5kvP3KzRReSDm%2BHgyCi2%2FXoO7eDZfdc"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264babc3996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1573

GET
H3 200 Color-417x90.png
creativedestructionmedia.com/wp-content/uploads/2019/02/ 17 KB
17 KB 59ms
56ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2019/02/Color-417x90.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5e031863afc70ff89bde055fe5405cc8758808cfa3629d997adbb2acf6bd5cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sun, 10 Feb 2019 14:46:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3500
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=orXLt44Qo2lyrd7TnmEyGAYZ3azBBghu7doySVVSI1ZY%2BnGpjnSVUF81IfAD0FHBWYeLc9aE516DbgKJukILX6HrI35RLaCdudFvtmLTh2jq18bJ%2BgB2%2Bbi67XdxI%2FHLFnZ0qU9kaQI%2F91kvpbYcfjEFYZEVGdeXYdJA"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264babc5996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17401

GET
H3 200 Color-116x25.png
creativedestructionmedia.com/wp-content/uploads/2019/02/ 5 KB
5 KB 54ms
52ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2019/02/Color-116x25.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29442b94e9fb88ea19926e07a72876dffccfaeb76782f69a2037576e3b415c26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sun, 10 Feb 2019 14:59:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F2W%2Beb31GUd7CmBj9kKrIZjLhHA9i8kutNt57XfvqpXBf44OiTBLekuauR4jgj5%2FY1xPxGTrAzjoqpJh4gBVHO26g4hhqfJ%2B3hnD4j8CTW4lnMh9dGcoE5mcRB1vwckb7LDleQAw5%2BqHe8N4GlJcFjoVzejpeE%2FADmw7"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264babc6996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4612

GET
H3 200 css
fonts.googleapis.com/ 2 KB
545 B 121ms
45ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Vollkorn&ver=6.0.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b1ac2a15d8cde0a9d51c87a83edf6c77e1260aa1d6b05022aeca1b900688a51c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Dec 2022 15:37:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Dec 2022 15:39:33 GMT

GET
H3 200 modal.min.js Show response
creativedestructionmedia.com/wp-content/plugins/podcast-subscribe-buttons/assets/js/ 5 KB
2 KB 52ms
49ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/podcast-subscribe-buttons/assets/js/modal.min.js?ver=1.0.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf917978118862ae1fc715ef2f5d7cf541d22cf515bc480c07324037b8bba01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 16 Oct 2022 21:53:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSYxSSrGcLBhGohEn1xzYd5Q2RPsyU5rpaM3OibdyDnYGGNQSZoE6POnhSVkHLgwzy5uOdsQKH6o62NQeJoq2gjnCafDC0H%2BBHtCzRBEbFAX4BjJJiGeZG3dxxmGOr75%2Fm6ZAWRmV%2B2mL5%2FZgMnn5IawC5RcLZgc7sBm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babb8996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 frontend.min.js Show response
creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/js/ 18 KB
5 KB 55ms
52ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=4.0.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6da22ca2b7058c87413a1927d90c13548535cfcb0959175fc0b32ac7417768b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vBXhxrPlm8SrFvfPhB68D%2BMuFrtrvnvBBmjONpUV9LmXH7JnXOWxLMoP9xXy6oh9sfpkKfQS%2Fa8K%2FgI2UbJmVNvhR05qY5CE8U7oCoJjXXBhDSJ%2FKpad8l3RQeyan5TGmt4CCXADatNu2IEV0SrNHXx0oX3v4Q3y2j0E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babba996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 script.lib.min.js Show response
creativedestructionmedia.com/wp-content/themes/pennews/js/ 407 KB
127 KB 63ms
59ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/js/script.lib.min.js?ver=6.6.1
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54e026f7f2e18074cbce4e26549c4f30daa4168d226d6f4d048a01638a89ca94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 Mar 2021 22:31:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qysxk7nvU07Wg0Eb81FCqP0I%2FQwW21qiYjDGgtgfTmwdDWN8yHHGbPGJqb1ZxYdkQz9xZ1ZEn5Rvz3ORbFxVLVqPfcsFz3hc9iHX8CRJHLYl6wyPgk2fTTTuJvGfELDQXZ3fWr%2F4u10foFca56JRORZqUyyKIzK%2BBWpW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babbb996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 script.min.js Show response
creativedestructionmedia.com/wp-content/themes/pennews/js/ 45 KB
12 KB 59ms
55ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/js/script.min.js?ver=6.6.1
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df07904cef6b39bb3662ce3980354f76a18829f78828aed882532bfcac2b93d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 20 Mar 2021 19:47:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vPdOFSg39ELdsLZ%2BkesAYXBI8whCb4tJoPSfVPqYyhwNQunymnzIG5N%2BjPx%2BRyUXWhrwk2Pr2C0KpOSEBy2rjx2SF4%2Bqqn9ki5kRxz34bL67ukF0Ku3hXUkvYK75ku70BHs8RIeU%2Blnb%2F66ER7txgkJX0vRXzGFQAoYX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babbc996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 comment-reply.min.js Show response
creativedestructionmedia.com/wp-includes/js/ 3 KB
2 KB 59ms
56ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-includes/js/comment-reply.min.js?ver=6.0.3
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iyHlg%2FUK5RvPvAvdlVq3%2F7ntVkr41QUAQKI7yjVCW0wp9Pdgcu5IfTR2oELZC%2FM%2FwzMCrGmZ4BhKUS7kpQLVJfAcnYxcw6nb2IRzkA6TL00bZGGzc1DsHhDfZnxbWUQV%2BEmOB8k30HfTIBWan4ZUWrmEnG3eYTd5ENPX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babbd996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.simplemodal.js Show response
creativedestructionmedia.com/wp-content/plugins/newsletter-leads/libs/simplemodal/ 23 KB
7 KB 50ms
47ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/newsletter-leads/libs/simplemodal/jquery.simplemodal.js?ver=1.2.8
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29577c7c68f7a6fcf2359fe3134ac6f7f93c9c28b9d1adde6ba9d6c79a1c7ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 16 Jul 2022 17:53:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2Bg4oCsuNTwvQZnSYK7mNSCr5FjU1eAYKabxdht8UQhDaysKFank4FhGAOPZNM3eGEQLUVIHFVWfsebRsUd5PYT8iYNqVcBIno2btfgZKZZjO6cTsp1zi%2BsrmE270ZUB3WzZU3HQuDuufaCE5a6esnQ2BjEPtgpBMZe5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babbe996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 148ms
52ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3251
etag: W/"ae63ef8ff03da61fffaa7f165729897a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7803264c4dc39bd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 30 Dec 2022 15:39:33 GMT

GET
H3 200 akismet-frontend.js Show response
creativedestructionmedia.com/wp-content/plugins/akismet/_inc/ 9 KB
3 KB 52ms
49ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1659017123
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92d6cc26916cd66aa6baa7829955829200236292f68561c1c0fc44cbf970b28d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 28 Jul 2022 14:05:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3500
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bHzymi8aV7c7tmXWeUgV5tbkSyUfrTu%2FRIJBzk8BJRjg2rvggJUEo%2FD%2BtwGzafjdxFlMqWzJD50OVO9Qa0%2FREe%2FiCIoIgoYG2q%2BWWrzWU57RYZ%2F6RL38aDRDeK0aG57yVevlVdXOIzdxJUBxpIXOgBv6zBrl3tN3a2AM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7803264babc7996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 badge.gif
static.getclicky.com/media/links/ 241 B
515 B 180ms
56ms Image
image/gif 2606:4700::6810:a010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.getclicky.com/media/links/badge.gif
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c93b5f9c2d83611b9a9ba0333b0b499b385cdce2aee9edaac6daf8a134cf5555

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Wed, 28 Dec 2022 19:37:56 GMT
date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Wed, 13 Apr 2016 00:13:35 GMT
server: cloudflare
age: 504097
etag: "570d8f2f-f1"
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7803264c6ab8bb83-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 241
x-proxy-cache: HIT

GET
H2 200 101335412.js Show response
static.getclicky.com/ 15 KB
5 KB 180ms
57ms Script
text/javascript 2606:4700::6810:a010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.getclicky.com/101335412.js
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57f35daeaf18c5fd0dfd54aa1e62d457f113d317b4df9cde5e2bd96cd271024a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Tue, 03 Jan 2023 08:46:34 GMT
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 27 Dec 2022 08:46:35 GMT
server: cloudflare
age: 24778
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=604800
cf-ray: 7803264c6abbbb83-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-proxy-cache: EXPIRED

GET
H3 200 pigeon-server Show response
my.creativedestructionmedia.com/action/public/vo/ 37 B
519 B 629ms
627ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://my.creativedestructionmedia.com/action/public/vo/pigeon-server?callback=PG_SPECIAL&action=get_special&json=%7B%22pigeon_version%22%3A%20%221.7%22%2C%20%22uri%22%3A%20%22https%3A%2F%2Fcreativedestructionmedia.com%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F%22%2C%20%22referrer%22%3A%20%22%22%7D&_=1672155572785

Requested by

Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f455a880c75fdef0c83a5623ef4fb1d941664b647fe51624082a0d3e30450c50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fyDEi%2FAn0zdv%2F%2BXskh6dA1om%2FmMG0EHXDwRRR4Y6aNwS6TC%2FQa4f3Wk9%2BZj9PoL2R3AyEnGO693ltdsYxOlN%2BRJakMLF4VyGp2O%2Bef58qyqSksZP4XGPW0lWeO9OqM0cg1uEsktgvniyVNdQkgdNa%2FEKhxnl9iUeS9Uo00dG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript;charset=utf-8
cf-ray: 7803264babc9996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 weathericons-regular-webfont.woff2
creativedestructionmedia.com/wp-content/themes/pennews/fonts/ 44 KB
44 KB 71ms
70ms Font
font/woff2 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/fonts/weathericons-regular-webfont.woff2
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9327647771c09df82095dba3591c77cca41a9cedca948ae01e7fb70c690dcbd5

Request headers

Referer: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sat, 09 Mar 2019 16:39:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3496
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6WWQMuRa%2FijENMSQgeMDyA0pw4OIfTMFGIX7Mn2fgNYgzTAcwkhNyW1i2Y3xbqGC1PMehOS%2FjMyEb1e5Ljbk4EFZJl%2Bzhq8%2BW6UL6D6EB1vqPdf3uF7mH1jbfJbczs0bJF476cp5HLebPwO7x5tC%2Frz1cl7GuCQ0%2BKmc"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264bcbfd996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44720

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 175ms
50ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CMukta+Vaani%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7COswald%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CTeko%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CUltra%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7CVollkorn%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%7COpen+Sans%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%3A300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C700%2C700italic%2C800%2C800italic%26subset%3Dcyrillic%2Ccyrillic-ext%2Cgreek%2Cgreek-ext%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 21 Dec 2022 19:33:08 GMT
x-content-type-options: nosniff
age: 504385
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:33:08 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 188ms
63ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 21 Dec 2022 19:34:12 GMT
x-content-type-options: nosniff
age: 504321
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:34:12 GMT

GET
H3 200 fontawesome-webfont.woff2
creativedestructionmedia.com/wp-content/themes/pennews/fonts/ 75 KB
76 KB 76ms
75ms Font
font/woff2 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sat, 09 Mar 2019 16:39:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3496
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kMr%2B2ZSU3CVco1fkMRmpdW6J5pNT93RTPr%2FMuBqLDnWWi%2F2FwdTDyaPeT9Qzms9F7CPIFAgky328P8JiZ2Z8En4LKsliX08jJsLS5zijoVdDpw8NALUUsxKcYRQ6laRKejnnONeG1yIMHM6HXgf2IJOKy%2Fj2UMPqG87n"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264bcc02996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 232ms
108ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 21 Dec 2022 19:33:00 GMT
x-content-type-options: nosniff
age: 504393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:33:00 GMT

GET
H2 200 TK3iWkUHHAIjg752GT8G.woff2
fonts.gstatic.com/s/oswald/v49/ 25 KB
25 KB 290ms
166ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v49/TK3iWkUHHAIjg752GT8G.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35c92598a5f32c018dc630f57b183b0284c211ce9c222e5b36840a62115262f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 21:12:07 GMT
x-content-type-options: nosniff
age: 66446
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25372
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 19:24:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 21:12:07 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 248ms
124ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 18:50:55 GMT
x-content-type-options: nosniff
age: 74918
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 18:50:55 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 339ms
220ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 01:58:46 GMT
x-content-type-options: nosniff
age: 481247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 01:58:46 GMT

GET
H2 200 0yb9GDoxxrvAnPhYGxkpaE0.woff2
fonts.gstatic.com/s/vollkorn/v21/ 43 KB
43 KB 320ms
206ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/vollkorn/v21/0yb9GDoxxrvAnPhYGxkpaE0.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37916b0c48fadfceebfbfb1777c42d5454209ccad3cf78db4a5565b32b53453e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 16:03:42 GMT
x-content-type-options: nosniff
age: 84951
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44004
x-xss-protection: 0
last-modified: Tue, 23 Aug 2022 18:35:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 16:03:42 GMT

GET
H3 200 Color-417x90-1.png
creativedestructionmedia.com/wp-content/uploads/2019/02/ 17 KB
17 KB 97ms
96ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2019/02/Color-417x90-1.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5e031863afc70ff89bde055fe5405cc8758808cfa3629d997adbb2acf6bd5cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sun, 10 Feb 2019 14:51:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3501
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ryl7YS%2Bo72bVHs%2B%2BgT0JtFw78bI6ok%2BEd9dshFd63AmUqEZpLR8i1GiZ1dr9CTReV5rWpAKAwwNmlbr9eGUb0pP8Cj1NBwOh6kQU8yIUB%2FS4hI%2B%2FtBKs5z2Xrll0fmXJGeHILAV%2BfVmCkmCYSyFMJw2yQzSrnHajozmD"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264bec29996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17401

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 306ms
236ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 21 Dec 2022 19:38:58 GMT
x-content-type-options: nosniff
age: 504035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17368
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:38:58 GMT

GET
H2 200 zOLy4prXmrtY-uT9wrI.woff2
fonts.gstatic.com/s/ultra/v19/ 13 KB
13 KB 301ms
232ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ultra/v19/zOLy4prXmrtY-uT9wrI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a515442e06d68ac60972b0e0f99195e0d27885218b3668004ef5c60e95e637c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 20 Dec 2022 23:51:34 GMT
x-content-type-options: nosniff
age: 575279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13616
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 20:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Dec 2023 23:51:34 GMT

GET
H2 200 3JnkSD_-ynaxmxnEfVHPIGW5U_BE8O4.woff2
fonts.gstatic.com/s/muktavaani/v13/ 21 KB
21 KB 294ms
225ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muktavaani/v13/3JnkSD_-ynaxmxnEfVHPIGW5U_BE8O4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a3a632adb68e48e2ee55ac140c3ca5f24bbbf886906c0ef9fdbf5c07cf1bb48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 04:22:05 GMT
x-content-type-options: nosniff
age: 127048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21536
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:27:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 04:22:05 GMT

GET
H3 200 line-awesome.woff2
creativedestructionmedia.com/wp-content/themes/pennews/fonts/ 44 KB
45 KB 51ms
50ms Font
font/woff2 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://creativedestructionmedia.com/wp-content/themes/pennews/fonts/line-awesome.woff2?v=1.1.
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 063a952901506e6cbcc2abdd1995ea387e4ae9138993f5517834a75faee165d0

Request headers

Referer: https://creativedestructionmedia.com/wp-content/themes/pennews/css/font-awesome.min.css?ver=4.5.2
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: HIT
last-modified: Sat, 09 Mar 2019 16:39:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3496
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xPb8VlVlYlsj%2B89snFwx%2BCZ8q0qequUEFiThIpXM3C%2FylQKpNsAvutWc5M0Yw%2FqO7hgsVSl0gcvzoCX2HZ1fnW3FcTdVawsEgsDDvCS%2Bn9h3GVoI5JGnj7Dg1krSDuQ8EKoBNiHAhAw%2FkxkB8Fp%2F6PrMHqgnQZYhHz%2F"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264c3c94996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45108

GET
H2 200 KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ 17 KB
17 KB 247ms
199ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 21 Dec 2022 19:38:58 GMT
x-content-type-options: nosniff
age: 504035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17032
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:38:58 GMT

GET
H2 200 0yb9GDoxxrvAnPhYGxknaE0GrQ.woff2
fonts.gstatic.com/s/vollkorn/v21/ 32 KB
32 KB 214ms
181ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/vollkorn/v21/0yb9GDoxxrvAnPhYGxknaE0GrQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02a9cfb474fe030a6d6c349d41d6f2cb66995540969c5cfc18ac0df652fe401a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 20 Dec 2022 22:02:20 GMT
x-content-type-options: nosniff
age: 581833
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32752
x-xss-protection: 0
last-modified: Tue, 23 Aug 2022 18:29:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Dec 2023 22:02:20 GMT

GET
H3 200 Screen-Shot-2022-12-22-at-2.15.34-PM-1024x578.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 1 MB
1 MB 409ms
408ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Screen-Shot-2022-12-22-at-2.15.34-PM-1024x578.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc19613738e819a6a177f90db9b1fe75e7343cbfdaffb037c217d6f72151ab9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 22 Dec 2022 19:17:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtvYDTpf9t5DmK4KgIolIrVDFg7ehntCzyB5c81ohMEHFX01dhzf1YNhN5h1LL5VutjQx2lU3TYgJZQe4y5SL16eDIvZCac7SAEw7UDV9i86YpxhufScWz1ntdYwZYsRcqEFMJjunAOJk6WqKEzRXUNnEym8XkPSI440"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7803264c8d2c996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1271391

GET
H2 200 azwidget-videos.php Show response
choiceclips.whatfinger.com/widgets/server/ 2 KB
1014 B 546ms
471ms XHR
text/html 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://choiceclips.whatfinger.com/widgets/server/azwidget-videos.php?widgetID=73cdf2a50c&width=24&cols=4&rows=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

acff1820ca73688f28b672f614e286c3ad77d187ce09919f8bbce811d4da1d1f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: gzip
p3p: CP="CAO PSA OUR"
x-sucuri-cache: MISS
content-length: 621
x-xss-protection: 1; mode=block
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=3600
x-sucuri-id: 15019
vary: Accept-Encoding
access-control-allow-headers: Origin

GET
H3 200 KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 155ms
51ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 01:19:26 GMT
x-content-type-options: nosniff
age: 483607
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11872
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 01:19:26 GMT

GET
H3 200 / Show response
www.instagram.com/reel/CklbT3yDugv/embed/captioned/ Frame 8894 88 KB
26 KB 118ms
117ms Document
text/html 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F

Requested by

Host: www.instagram.com
URL: https://www.instagram.com/embed.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9ccad993216276fc9c27678222dd756704bd330065d5b68ee2e2a9a3eadf31f3

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.instagram.com/security/csp_report/; default-src 'self' https://www.instagram.com; img-src data: blob: https://.fbcdn.net https://.instagram.com https://.cdninstagram.com https://.facebook.com https://.fbsbx.com https://.giphy.com; font-src data: https://.fbcdn.net https://.instagram.com https://.cdninstagram.com; media-src 'self' blob: https://www.instagram.com https://.cdninstagram.com https://.fbcdn.net; manifest-src 'self' https://www.instagram.com; script-src 'self' https://instagram.com https://www.instagram.com https://.www.instagram.com https://.cdninstagram.com wss://www.instagram.com https://.facebook.com https://.fbcdn.net https://.facebook.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https://.www.instagram.com https://www.instagram.com 'unsafe-inline'; connect-src 'self' https://instagram.com https://www.instagram.com https://.www.instagram.com https://graph.instagram.com https://.graph.instagram.com https://i.instagram.com/graphql_www https://graphql.instagram.com https://.cdninstagram.com https://api.instagram.com https://i.instagram.com https://.i.instagram.com https://.od.instagram.com wss://www.instagram.com wss://edge-chat.instagram.com https://.facebook.com https://.fbcdn.net https://.facebook.net chrome-extension://boadgeojelhgndaghljhdicfkmllpafd blob:; worker-src 'self' blob: https://www.instagram.com; frame-src 'self' https://instagram.com https://www.instagram.com https://.instagram.com https://staticxx.facebook.com https://www.facebook.com https://web.facebook.com https://connect.facebook.net https://m.facebook.com https://*.fbsbx.com; object-src 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://creativedestructionmedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-expose-headers: X-IG-Set-WWW-Claim
alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: gzip
content-language: de
content-security-policy: report-uri https://www.instagram.com/security/csp_report/; default-src 'self' https://www.instagram.com; img-src data: blob: https://*.fbcdn.net https://*.instagram.com https://*.cdninstagram.com https://*.facebook.com https://*.fbsbx.com https://*.giphy.com; font-src data: https://*.fbcdn.net https://*.instagram.com https://*.cdninstagram.com; media-src 'self' blob: https://www.instagram.com https://*.cdninstagram.com https://*.fbcdn.net; manifest-src 'self' https://www.instagram.com; script-src 'self' https://instagram.com https://www.instagram.com https://*.www.instagram.com https://*.cdninstagram.com wss://www.instagram.com https://*.facebook.com https://*.fbcdn.net https://*.facebook.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https://*.www.instagram.com https://www.instagram.com 'unsafe-inline'; connect-src 'self' https://instagram.com https://www.instagram.com https://*.www.instagram.com https://graph.instagram.com https://*.graph.instagram.com https://i.instagram.com/graphql_www https://graphql.instagram.com https://*.cdninstagram.com https://api.instagram.com https://i.instagram.com https://*.i.instagram.com https://*.od.instagram.com wss://www.instagram.com wss://edge-chat.instagram.com https://*.facebook.com https://*.fbcdn.net https://*.facebook.net chrome-extension://boadgeojelhgndaghljhdicfkmllpafd blob:; worker-src 'self' blob: https://www.instagram.com; frame-src 'self' https://instagram.com https://www.instagram.com https://*.instagram.com https://staticxx.facebook.com https://www.facebook.com https://web.facebook.com https://connect.facebook.net https://m.facebook.com https://*.fbsbx.com; object-src 'none'; upgrade-insecure-requests
content-type: text/html; charset=utf-8
cross-origin-embedder-policy-report-only: require-corp;report-to="coep"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop"
date: Tue, 27 Dec 2022 15:39:33 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-trial: AuqWincgAuXeuu3KypEMnrrFEJHySaesyJS3EaIH40zvafzrU0Irhb7+5QwZpOqMZrPTjgvFl7Z5jJgy1dNAcQMAAAB6eyJvcmlnaW4iOiJodHRwczovL2luc3RhZ3JhbS5jb206NDQzIiwiZmVhdHVyZSI6IkNyb3NzT3JpZ2luT3BlbmVyUG9saWN5UmVwb3J0aW5nIiwiZXhwaXJ5IjoxNjEzNDExNjYyLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
pragma: no-cache
priority: u=0
report-to: {"group": "coep", "max_age": 86400, "endpoints": [{"url": "/security/coep_report/"}]},{"group": "coop", "max_age": 86400, "endpoints": [{"url": "/security/coop_report/"}]}
strict-transport-security: max-age=31536000
vary: Accept-Language, Cookie, Accept-Encoding
x-accel-buffering: no
x-aed: 75
x-content-type-options: nosniff
x-ig-origin-region: cln
x-ig-peak-time: 1
x-ig-push-state: c2
x-ig-request-elapsed-time-ms: 46
x-xss-protection: 0

GET
H3 200 LYjCdG7kmE0gdRhYsCRgqA.woff2
fonts.gstatic.com/s/teko/v15/ 13 KB
13 KB 112ms
55ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/teko/v15/LYjCdG7kmE0gdRhYsCRgqA.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ac7f47be06ed56cebf7d19f23386fa58144a3fec5dfb68a82edcecc20df444a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 20 Dec 2022 18:03:51 GMT
x-content-type-options: nosniff
age: 596142
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12908
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Dec 2023 18:03:51 GMT

GET
H2 200 jquery.mousewheel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/ 3 KB
2 KB 144ms
51ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js

Requested by

Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2239386
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1046
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-ad3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f41b2AK3wqIHZtskBdy7TpGbMMUSo4pwUAjGwj5fDMybyNJeb5KHr8qR40hEDWs5O800V2KA1D%2Bb1TjK41t82cXfduy43dc95uoBZqxi7QaLtDH%2FWWmDbcLrZ%2B8f0SrdjbK5H9M37H1o%2FrvqYWsYUSCP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7803264dec049096-FRA
expires: Sun, 17 Dec 2023 15:39:33 GMT

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 92ms
52ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.3

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3273
etag: W/"2f96824aee4bf927e734cc519e3e726d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 7803264dac339244-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 30 Dec 2022 15:39:33 GMT

GET
H2 200 1f1e7-1f1f7.svg
s.w.org/images/core/emoji/14.0.0/svg/ 682 B
928 B 129ms
36ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f1e7-1f1f7.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

a74ec5e2fe1a2f859edf8c7de03b43379030f58f17b8e57371a347620f5c9b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:50:59 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 682
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f622.svg
s.w.org/images/core/emoji/14.0.0/svg/ 1 KB
610 B 130ms
36ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f622.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

5527ea193cb91de1cea4f3e273eb53b029afc536f1bc79c7ce38e95e658e006e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:50:38 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f64c.svg
s.w.org/images/core/emoji/14.0.0/svg/ 2 KB
2 KB 129ms
36ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f64c.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

a0a2d0a480c0a1d11deb8abc7199c9a225294b11686a7d07816b187f66ecdb69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:47:50 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 2210
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f64f-1f3fb.svg
s.w.org/images/core/emoji/14.0.0/svg/ 1 KB
2 KB 130ms
37ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f64f-1f3fb.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

f1e53b769e7bf6486d9d6feb2c1318047bae3643291710c27648d7c1c6f00198

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:50:38 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 1511
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f623.svg
s.w.org/images/core/emoji/14.0.0/svg/ 1 KB
765 B 130ms
37ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f623.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

04b3d865ce727c0a876103fe37cf2c0040772f409352abe0c6f80250c197419b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:50:38 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f64f-1f3fd.svg
s.w.org/images/core/emoji/14.0.0/svg/ 1 KB
2 KB 130ms
37ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f64f-1f3fd.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

5d9684cf63a19c44cf689180f7f37f61570a03d3a8a03ddaeb4e86fdc21155d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:50:59 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 1511
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f64f.svg
s.w.org/images/core/emoji/14.0.0/svg/ 1 KB
692 B 48ms
47ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/1f64f.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

8507d163d2a5c3e4ae298f241d74883e6481b720e78543c08291102ec738b433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:47:26 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 m-outer-da551b803dc55c2dc0b4b9bdfeabba62.html Show response
js.stripe.com/v3/ Frame 4E70 200 B
807 B 56ms
56ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-da551b803dc55c2dc0b4b9bdfeabba62.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

31fe1bafd74b7bc8bb88aca7960401d95b1a6de990b9cbadc562c173b8c560e7

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://creativedestructionmedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 326591
cache-control: max-age=31536000
content-encoding: br
content-length: 121
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 27 Dec 2022 15:39:33 GMT
etag: "da551b803dc55c2dc0b4b9bdfeabba62"
last-modified: Fri, 23 Dec 2022 20:55:09 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 151745
x-content-type-options: nosniff
x-request-id: 761f0b9b-1406-4c8c-ba45-91ca89584e2c
x-served-by: cache-hhn-etou8220097-HHN

GET
H3 200 67ac6f7b1749.css
www.instagram.com/static/bundles/es6/EmbedSimpleBase.css/ Frame 8894 17 KB
3 KB 39ms
38ms Stylesheet
text/css 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedSimpleBase.css/67ac6f7b1749.css
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: c05a202bfec3c0e8fdba6936f9cf8ac41bcafd546ce89f29d16d6e347963fd6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 17:17:04 GMT
content-encoding: br
etag: "67ac6f7b1749"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 3082
priority: u=0

GET
H3 200 e0bcdd7e3f5b.js Show response
www.instagram.com/static/bundles/es6/de_DE.js/ Frame 8894 295 KB
70 KB 40ms
39ms Script
text/javascript 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/de_DE.js/e0bcdd7e3f5b.js
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: aa612e58f9239911730a9653ae895ba3750157de71413b902512590bbbbcf58a

Request headers

Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Origin: https://www.instagram.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 22:22:44 GMT
content-encoding: br
etag: "e0bcdd7e3f5b"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 71699
priority: u=1

GET
H3 200 4515fcaa5551.js Show response
www.instagram.com/static/bundles/es6/EmbedSimple.js/ Frame 8894 495 KB
119 KB 41ms
39ms Script
text/javascript 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedSimple.js/4515fcaa5551.js
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 2d3f90cd3335ea94073b894d19ba1041bcd3c7202cf98e741e7e93d428c5dccf

Request headers

Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Origin: https://www.instagram.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 22:22:46 GMT
content-encoding: br
etag: "4515fcaa5551"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 121423
priority: u=1

POST
H2 200 csp-report
q.stripe.com/ Frame 4E70 0
570 B 636ms
202ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-envoy-upstream-service-time: 1
content-length: 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 4E70 0
571 B 635ms
201ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-envoy-upstream-service-time: 1
content-length: 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 m-outer-43a3f10a091543c9b0b5776f4b2fbc8d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4E70 1 KB
678 B 37ms
37ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-43a3f10a091543c9b0b5776f4b2fbc8d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-da551b803dc55c2dc0b4b9bdfeabba62.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

784672eeb9a9c4a2656d5f0c838230d8808259520a21b74aa835050c93529e52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/m-outer-da551b803dc55c2dc0b4b9bdfeabba62.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 27 Dec 2022 15:39:33 GMT
via: 1.1 varnish
age: 326591
x-cache: HIT
content-length: 550
x-request-id: 1cd9745e-b3bf-45e4-bc41-b70741a2c0ee
x-served-by: cache-hhn-etou8220097-HHN
last-modified: Fri, 23 Dec 2022 20:55:08 GMT
server: Fastly
etag: "ba3b5093ebce20757a5cf45d9f166d0e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 138626

GET
H2 200 51705800_2300830020158971_2636765106884575232_n.jpg
scontent.cdninstagram.com/v/t51.2885-19/ Frame 8894 5 KB
5 KB 133ms
43ms Image
image/jpeg 2a03:2880:f22d:c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.cdninstagram.com/v/t51.2885-19/51705800_2300830020158971_2636765106884575232_n.jpg?stp=dst-jpg_s150x150&_nc_ht=scontent.cdninstagram.com&_nc_cat=107&_nc_ohc=tDWHSvv1eDsAX9pVYCd&edm=AJBgZrYBAAAA&ccb=7-5&oh=00_AfDDnGuLMmSh1tVJq7AnCJXeXRcbiARaNGbVCJ74nZeaMQ&oe=63AF47FD&_nc_sid=78c662
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f22d:c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 6a9ab47bf0804d5975612c06e6bc5e7520879529c3ad311c4ce35668a0da3363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-haystack-needlechecksum: 3151191342
date: Tue, 27 Dec 2022 15:39:33 GMT
x-fb-trip-id: 780166575
x-storage-error-category: dfs:none;hs_p:200:HS_ESUCCESS
last-modified: Fri, 01 Mar 2019 06:28:49 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=161513057
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2127373216
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 5430

GET
H2 200 314461450_143487381495636_4617162980782175350_n.jpg
scontent.cdninstagram.com/v/t51.2885-15/ Frame 8894 23 KB
23 KB 133ms
43ms Image
image/jpeg 2a03:2880:f22d:c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.cdninstagram.com/v/t51.2885-15/314461450_143487381495636_4617162980782175350_n.jpg?stp=dst-jpg_e15&_nc_ht=scontent.cdninstagram.com&_nc_cat=100&_nc_ohc=l3A8XhwQlLUAX-k4PEc&edm=AJBgZrYBAAAA&ccb=7-5&oh=00_AfDrfVNnCA8K_fNa3Z_Geln-Pvz3qq8kFYq30ESZnyiJfg&oe=63ACD6BF&_nc_sid=78c662
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f22d:c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 65e44a7952d26fcbb6efc7f9613cba40be50d352183045a4b9c9ea45fe7f8dea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-haystack-needlechecksum: 407518755
date: Tue, 27 Dec 2022 15:39:33 GMT
x-fb-trip-id: 780166575
x-storage-error-category: dfs:none;hs_p:200:HS_ESUCCESS
last-modified: Sat, 05 Nov 2022 15:48:51 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=539618036
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3044134287
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 23097

GET
H2 200 320802119_513002483951151_9078755140502971994_n.jpg
scontent.cdninstagram.com/v/t51.2885-15/ Frame 8894 7 KB
7 KB 128ms
39ms Image
image/jpeg 2a03:2880:f22d:c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.cdninstagram.com/v/t51.2885-15/320802119_513002483951151_9078755140502971994_n.jpg?stp=c280.0.720.720a_dst-jpg_e15_s150x150&_nc_ht=scontent.cdninstagram.com&_nc_cat=103&_nc_ohc=ap6bItUDn1cAX-tEhln&edm=AJBgZrYBAAAA&ccb=7-5&oh=00_AfDaXPM85lsmixWEvy7GbCtiUS7DJ3EvmdO0ylouO2PCZw&oe=63ACF8E6&_nc_sid=78c662
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f22d:c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 962604c2cecfdd27ddfff445e7ffa338ecf8ed66da651b023c8aa688c0368766

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
x-fb-trip-id: 780166575
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Wed, 21 Dec 2022 01:29:29 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=1584691141
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2172649287
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 6923

GET
H2 200 319892940_715902033006003_6979272122063390587_n.jpg
scontent.cdninstagram.com/v/t51.2885-15/ Frame 8894 8 KB
8 KB 132ms
43ms Image
image/jpeg 2a03:2880:f22d:c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.cdninstagram.com/v/t51.2885-15/319892940_715902033006003_6979272122063390587_n.jpg?stp=c157.0.406.406a_dst-jpg_e15_s150x150&_nc_ht=scontent.cdninstagram.com&_nc_cat=103&_nc_ohc=5ctnrBmEiqkAX_EtPwF&edm=AJBgZrYBAAAA&ccb=7-5&oh=00_AfDP_91iNxyT-hMCSRGnLjKk5Hm8Rkc3Q1sr5tHltg30yw&oe=63AC91F5&_nc_sid=78c662
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f22d:c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: d4ede232c81b584c3365b4a5fb756b6d7a762fbeb710e7cb12986c7c311364c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-haystack-needlechecksum: 642821494
date: Tue, 27 Dec 2022 15:39:33 GMT
x-fb-trip-id: 780166575
x-storage-error-category: dfs:none;hs_p:200:HS_ESUCCESS
last-modified: Wed, 14 Dec 2022 03:49:24 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=4040000316
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3483603905
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 8414

GET
H3 200 3e5c3713b6fd.css
www.instagram.com/static/bundles/es6/EmbedRichBase.css/ Frame 8894 114 KB
13 KB 37ms
37ms Stylesheet
text/css 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedRichBase.css/3e5c3713b6fd.css
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 548005b1d32066c8d7ab7b2f74d0d066d2607dc63bb3b6604ac7bc6f0eb38207

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 22:07:15 GMT
content-encoding: br
etag: "3e5c3713b6fd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 12994
priority: u=2

GET
H3 200 f906e30c9870.js Show response
www.instagram.com/static/bundles/es6/EmbedRich.js/ Frame 8894 882 KB
204 KB 38ms
37ms Script
text/javascript 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedRich.js/f906e30c9870.js
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 5df946a5d4487aa5c327efc12c21a1b288041fe5276f03c03fa72e8aa513b015

Request headers

Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Origin: https://www.instagram.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 16 Dec 2022 01:04:00 GMT
content-encoding: br
etag: "f906e30c9870"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 209154
priority: u=3,i

GET
H2 200 in.php Show response
in.getclicky.com/ 133 B
357 B 556ms
180ms Script
text/javascript 198.145.13.12
DF-PTL1

General

Check archive.org

Show headers Download Go to

Full URL: https://in.getclicky.com/in.php?site_id=101335412&type=pageview&href=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F&title=SUSPICIOUS%20ELECTIONS%20IN%20BRAZIL%3A%20FORENSIC%20ANALYSIS%20DEMONSTRATES%20EVEN%20MORE%20EVIDENCE%20OF%20FALSEHOOD%20IN%20BRAZILIAN%20ELECTION%20DATA-%20AS%20IF%20IT%20WERE%20NEEDED%20-%20CD%20Media&res=1600x1200&lang=en-US&tz=Etc%2FUnknown&tc=&ck=1&mime=js&x=0.23672373897365495
Requested by: Host: static.getclicky.com
URL: https://static.getclicky.com/101335412.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.145.13.12 , United States, ASN2044 (DF-PTL1, US),
Reverse DNS: getclicky.com
Software: nginx /
Resource Hash: c01a7aecfc31ccf424ee0b7a5293514789aad354d4159849b70ac2bd8be3d46a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate, post-check=0, pre-check=0
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/18410033-97a0-42b0-8618-37cc421b8342/ 3 KB
2 KB 60ms
46ms Script
text/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/18410033-97a0-42b0-8618-37cc421b8342/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bcfc55ef9a3bc1b3ee5d65d431998352afd3984c9f3301d7ee7667350fdd0e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
age: 3496
cf-polished: origSize=3435
status: 200 OK
x-envoy-upstream-service-time: 29
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 83bf164f-a871-453d-8267-79e1808cc13e
x-runtime: 0.026858
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"be57f275d13151237d7d25bd97bae93b"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 7803264f5aa79bd7-FRA
access-control-allow-headers: SDK-Version
expires: Tue, 27 Dec 2022 16:39:33 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame F05A 930 B
2 KB 162ms
46ms Document
text/html 99.86.159.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-43a3f10a091543c9b0b5776f4b2fbc8d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.159.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-159-40.mxp64.r.cloudfront.net

Software

Cloudfront /

Resource Hash

a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 251
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 27 Dec 2022 15:37:47 GMT
etag: "fc2e029628f163bb59adc6fa5a31161c"
last-modified: Thu, 17 Mar 2022 19:03:12 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 64af8cd36297d6f17b63f43a68ec6756.cloudfront.net (CloudFront)
x-amz-cf-id: Q-Tw6K8Qpqtkk_-Gf8LTj7YGmbURfSriYsR0tmXnGGC4SvLY-GUkRA==
x-amz-cf-pop: MXP64-C2
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 6c7742894eb6.png
www.instagram.com/static/bundles/es6/sprite_embed_6c7742894eb6.png/ Frame 8894 13 KB
13 KB 39ms
38ms Image
image/png 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/bundles/es6/sprite_embed_6c7742894eb6.png/6c7742894eb6.png
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedSimpleBase.css/67ac6f7b1749.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 23beda30424ac7c49957ce15299d0199803995498851441548cf89108a12871b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/static/bundles/es6/EmbedSimpleBase.css/67ac6f7b1749.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 21:05:33 GMT
content-encoding: br
etag: "6c7742894eb6"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 12978
priority: u=3,i

GET
H3 200 3e5c3713b6fd.css
www.instagram.com/static/bundles/es6/EmbedRich.css/ Frame 8894 114 KB
13 KB 39ms
37ms Stylesheet
text/css 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedRich.css/3e5c3713b6fd.css
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedSimple.js/4515fcaa5551.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 548005b1d32066c8d7ab7b2f74d0d066d2607dc63bb3b6604ac7bc6f0eb38207

Request headers

Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Origin: https://www.instagram.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 22:54:34 GMT
content-encoding: br
etag: "3e5c3713b6fd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 12994
priority: u=0

GET
H3 200 2fdc79aa66b0.png
www.instagram.com/static/bundles/es6/sprite_video_2fdc79aa66b0.png/ Frame 8894 5 KB
5 KB 37ms
37ms Image
image/png 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.instagram.com/static/bundles/es6/sprite_video_2fdc79aa66b0.png/2fdc79aa66b0.png
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedRichBase.css/3e5c3713b6fd.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 54c2687de64bd6df6f87c864412becc0ba8c43282e84fd5ef7949c347498b2c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.instagram.com/static/bundles/es6/EmbedRichBase.css/3e5c3713b6fd.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Wed, 14 Dec 2022 17:17:00 GMT
content-encoding: br
etag: "2fdc79aa66b0"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 4684
priority: u=1

POST
H2 200 csp-report
q.stripe.com/ Frame F05A 0
344 B 276ms
202ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: nginx
cross-origin-opener-policy: same-origin
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
x-robots-tag: none
content-length: 0
expires: 0

GET
H3 200 css
fonts.googleapis.com/ 3 KB
643 B 46ms
45ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cd9216308f7433d319f912cfc029861f0176f0d0af13c57338d291f757fb01de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 27 Dec 2022 15:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Dec 2022 14:41:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Dec 2022 15:39:33 GMT

GET
H2 200 1lists-600x316.png
choiceclips.whatfinger.com/wp-content/uploads/2022/12/ 86 KB
84 KB 38ms
36ms Image
image/png 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choiceclips.whatfinger.com/wp-content/uploads/2022/12/1lists-600x316.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

481734c0d4cc6e4a4c5d21ba877fb47686041edf31a3c5764a5ca1818cedcfe9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
last-modified: Tue, 27 Dec 2022 03:11:34 GMT
server: nginx
content-encoding: gzip
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
x-sucuri-cache: HIT
cache-control: max-age=315360000
x-sucuri-id: 15019
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1markd-600x314.png
choiceclips.whatfinger.com/wp-content/uploads/2022/12/ 219 KB
219 KB 111ms
110ms Image
image/png 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choiceclips.whatfinger.com/wp-content/uploads/2022/12/1markd-600x314.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

2955a48ba0f06efe1174d25c3ded83160a53fad345cec5c7a5bfacdcfecbe359

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
last-modified: Mon, 26 Dec 2022 21:46:52 GMT
server: nginx
content-encoding: gzip
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
x-sucuri-cache: HIT
cache-control: max-age=315360000
x-sucuri-id: 15019
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wf7-1-600x370.png
choiceclips.whatfinger.com/wp-content/uploads/2022/12/ 310 KB
309 KB 111ms
111ms Image
image/png 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choiceclips.whatfinger.com/wp-content/uploads/2022/12/wf7-1-600x370.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

7f60f220836a7efb68485941d75c01ab1b0af071a2d0a5b13563c492fa0f4dc0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
last-modified: Mon, 26 Dec 2022 21:33:51 GMT
server: nginx
content-encoding: gzip
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
x-sucuri-cache: HIT
cache-control: max-age=315360000
x-sucuri-id: 15019
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 trump.jpg
choiceclips.whatfinger.com/wp-content/uploads/2022/09/ 8 KB
8 KB 111ms
111ms Image
image/jpeg 192.124.249.69
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://choiceclips.whatfinger.com/wp-content/uploads/2022/09/trump.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.69 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10069.sucuri.net

Software

nginx /

Resource Hash

8b8fc77efe2a8543d1bdb8e50931d3a7e11e84743e84acf9b628bec0fb588051

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: gzip
x-sucuri-cache: HIT
content-length: 7835
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 13:21:12 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=315360000
x-sucuri-id: 15019
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 pigeon-server Show response
my.creativedestructionmedia.com/action/public/vo/ 267 B
681 B 308ms
308ms Script
application/javascript 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://my.creativedestructionmedia.com/action/public/vo/pigeon-server?callback=PGPW&json=%7B%22pigeon_version%22%3A%20%221.7%22%2C%20%22uri%22%3A%20%22https%3A%2F%2Fcreativedestructionmedia.com%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F%22%2C%20%22referrer%22%3A%20%22%22%2C%20%22set_session%22%3A%201%2C%20%22pfp%22%3A%20%2240f8525d1c45f830bfd2e884c08393f5%22%2C%20%22content_access%22%3A%200%2C%20%22content_id%22%3A%2053173%2C%20%22content_title%22%3A%20%22SUSPICIOUS%2BELECTIONS%2BIN%2BBRAZIL%253A%2BFORENSIC%2BANALYSIS%2BDEMONSTRATES%2BEVEN%2BMORE%2BEVIDENCE%2BOF%2BFALSEHOOD%2BIN%2BBRAZILIAN%2BELECTION%2BDATA-%2BAS%2BIF%2BIT%2BWERE%2BNEEDED%22%2C%20%22content_date%22%3A%20%222022-12-22%2B19%253A33%253A29%22%2C%20%22content_price%22%3A%200%2C%20%22content_value%22%3A%200%2C%20%22content_prompt%22%3A%200%2C%20%22wp_post_type%22%3A%20%22post%22%2C%20%22redirect%22%3A%200%7D&_=1672155572786

Requested by

Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecaf7c6120c108f09f760713589c1e26eee65c67a5e220a0eb2f25632a449d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XK2fjIpXZe29LlFE%2Bie1H0cTRObHEjKc2W4ePA3GYMTjJMVt6jNVk9CaAM7%2B1wUhOlwl0X4cY0Z2aA2OPLVBEFL39R8Lb%2BQVKcXGYk4y20YeFT%2Bx7RTNPJ0VebpADEzAAwcvJFOMrwSBM0FCqzVmYXxf%2FgcFtClaXtYzcMi9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript;charset=utf-8
cf-ray: 78032650ecc1996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 out-4.5.42.js Show response
m.stripe.network/ Frame F05A 86 KB
14 KB 52ms
52ms Script
text/javascript 99.86.159.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.42.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.159.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-159-40.mxp64.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 27 Dec 2022 15:36:31 GMT
last-modified: Thu, 17 Mar 2022 19:03:12 GMT
server: Cloudfront
via: 1.1 64af8cd36297d6f17b63f43a68ec6756.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP64-C2
etag: W/"21df7244385e5c0bdf32da01d0dad6c0"
age: 185
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
x-amz-cf-id: hNklWPVN1RKq4cv_adCQZLd6fdD_RT1a1LGPRl89KsUbWehtPAICAw==

GET
H3 200 66d8f00956e9.js Show response
www.instagram.com/static/bundles/es6/EmbedAsyncLogger.js/ Frame 8894 2 KB
756 B 37ms
37ms Script
text/javascript 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://www.instagram.com/static/bundles/es6/EmbedAsyncLogger.js/66d8f00956e9.js
Requested by: Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedSimple.js/4515fcaa5551.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 2ca69feef28c20ecd1ceecd849a2d43b1579310195a5d9bd469e2266b84f868f

Request headers

Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
Origin: https://www.instagram.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 00:00:44 GMT
content-encoding: br
etag: "66d8f00956e9"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
edge-control: max-age=1209600, no-transform
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 733
priority: u=3,i

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 65ms
65ms Stylesheet
text/css 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3262
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 7803265119f19244-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 26 Jan 2023 15:39:33 GMT

GET
H3 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ 16 KB
16 KB 51ms
51ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://creativedestructionmedia.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 18:53:44 GMT
x-content-type-options: nosniff
age: 74749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 18:53:44 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame F05A 156 B
523 B 651ms
206ms XHR
application/json 35.160.214.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.42.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.160.214.55 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-160-214-55.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

1a6ec332f581bd6eb6fccca35ecdcad88f079961138a1e1b05b7d7e5924f3090

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
content-type: application/json;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/18410033-97a0-42b0-8618-37cc421b8342/ 176 B
603 B 117ms
68ms Fetch
application/json 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/18410033-97a0-42b0-8618-37cc421b8342/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ea4399322b476f7be24324722c9e3ed7ebfa5e97955bfd4d11a1792be303943

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
status: 200 OK
x-envoy-upstream-service-time: 9
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: d0c24ac0-7b1d-4257-82e6-914de9cf9b21
x-runtime: 0.007461
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"0ea4399322b476f7be24324722c9e3ed"
x-download-options: noopen
vary: Accept, Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 780326528eacbb49-FRA
access-control-allow-headers: SDK-Version

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 136ms
52ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b3231dbda0ba29dd7ec8c261181d2eda15c31c0aec2e7ee376f7d229371eed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27536
x-xss-protection: 0
server: sffe
etag: "1433 / 44 of 1000 / last-modified: 1670587517"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 27 Dec 2022 15:39:34 GMT

GET
H2 200 2659176.js Show response
prebid.dblks.net/ff/ 523 KB
524 KB 392ms
123ms Script
application/javascript 199.212.255.211
FHMNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.dblks.net/ff/2659176.js
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.212.255.211 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.14.1 /
Resource Hash: fb2dfaf032a461215f7fe0ee873b2e6b9b617d11e5fdfd023c79fa1716159867

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: application/javascript
date: Tue, 27 Dec 2022 15:39:34 GMT
cache-control: max-age=1800, public, no-transform
server: nginx/1.14.1
expires: Tue, 27 Dec 2022 16:09:34 GMT

GET
H2 200 33a98319-d93a-47fd-add8-19dd17d78e10.png
img.onesignal.com/t/ 12 KB
12 KB 63ms
45ms Image
image/png 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.onesignal.com/t/33a98319-d93a-47fd-add8-19dd17d78e10.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ceba4a27d1d5b002e5f9cc114910456581da48b66753f5c133b6280057c11811

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
x-amz-meta-cache-control: public, maxage=604800
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains
x-amz-request-id: GJTGDHK28QXE0TQ5
age: 3496
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12376
x-amz-id-2: Eo8WSIriHhhqBNWazum3tUvXKU8QufR4O1iMU4DYQ0veCoHXYWQisfax4glzAprc73xlF/raaYY=
last-modified: Sun, 21 Apr 2019 18:35:15 GMT
server: cloudflare
etag: "2cb20e96be0d57d9f3945cb5373ed552"
vary: Accept-Encoding
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 7803265339539bd7-FRA
expires: Fri, 27 Jan 2023 15:39:34 GMT

GET
H3 200 pubads_impl_2022120501.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
129 KB 113ms
37ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 11:38:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14472
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131905
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 09:36:10 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 27 Dec 2023 11:38:22 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 136 B
105 B 148ms
73ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=creativedestructionmedia.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62f17afd48cf4e9be231b5ae10e836a6692c0679c2db163d73a9409f20d1dc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80
x-xss-protection: 0
expires: Tue, 27 Dec 2022 15:39:34 GMT

OPTIONS
H2 200 logging_client_events
graph.instagram.com/ Frame 0
0 159ms
67ms Preflight
application/json 2a03:2880:f21c:80c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.instagram.com/logging_client_events

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f21c:80c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept: */*
Access-Control-Request-Headers: x-asbd-id
Access-Control-Request-Method: POST
Origin: https://www.instagram.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-headers: x-asbd-id
access-control-allow-methods: GET, POST, DELETE, OPTIONS
access-control-allow-origin: *
access-control-max-age: 300
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-type: application/json; charset=UTF-8
date: Tue, 27 Dec 2022 15:39:35 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v9.0
pragma: no-cache
priority: u=3,i
strict-transport-security: max-age=15552000
vary: Origin
x-fb-debug: BwM+xFU8yd7F/x8oGkI+eaVmoyrHSbwaMQ80bOg4/Zl5wE3iYUPbgMNvc+vL/PBx21L/7AekraSInxykgn2m5Q==
x-fb-request-id: A0vK4d4nx_nCd3yRCcNg559
x-fb-rev: 1006771437
x-fb-rlafr: 0
x-fb-trace-id: EavJLawvZDT
x-fb-trip-id: 2050670934

POST
H2 200 logging_client_events Show response
graph.instagram.com/ Frame 8894 107 B
293 B 66ms
66ms XHR
application/json 2a03:2880:f21c:80c4:face:b00c:0:43fe
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.instagram.com/logging_client_events

Requested by

Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedSimple.js/4515fcaa5551.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f21c:80c4:face:b00c:0:43fe Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9b7c9bb91016a0d17171d9a9307591530d2211c64f33104a1b87299a6b386f95

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept: */*
Referer: https://www.instagram.com/
X-ASBD-ID: 198387
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000
date: Tue, 27 Dec 2022 15:39:35 GMT
cross-origin-resource-policy: cross-origin
x-fb-rev: 1006771437
content-length: 107
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: RJG1p7pHMXF3Psa/p0mIdjKZIhzi1tZUNPvJaVH/0aGs2KSN9z6N4dewvAHTUkBDp0EdUqrCmw362RH7kQW7hg==
x-fb-trip-id: 2050670934
x-fb-trace-id: D7zZMr34Lv3
vary: Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: ANmjSaYj_pV7dZp7MVSJOBp
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v9.0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 200 falco Show response
www.instagram.com/logging/ Frame 8894 15 B
62 B 95ms
94ms XHR
application/json 2a03:2880:f21c:80e5:face:b00c:0:4420
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.instagram.com/logging/falco

Requested by

Host: www.instagram.com
URL: https://www.instagram.com/static/bundles/es6/EmbedSimple.js/4515fcaa5551.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f21c:80e5:face:b00c:0:4420 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.instagram.com/security/csp_report/; default-src 'self' https://www.instagram.com; img-src data: blob: https://.fbcdn.net https://.instagram.com https://.cdninstagram.com https://.facebook.com https://.fbsbx.com https://.giphy.com; font-src data: https://.fbcdn.net https://.instagram.com https://.cdninstagram.com; media-src 'self' blob: https://www.instagram.com https://.cdninstagram.com https://.fbcdn.net; manifest-src 'self' https://www.instagram.com; script-src 'self' https://instagram.com https://www.instagram.com https://.www.instagram.com https://.cdninstagram.com wss://www.instagram.com https://.facebook.com https://.fbcdn.net https://.facebook.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https://.www.instagram.com https://www.instagram.com 'unsafe-inline'; connect-src 'self' https://instagram.com https://www.instagram.com https://.www.instagram.com https://graph.instagram.com https://.graph.instagram.com https://i.instagram.com/graphql_www https://graphql.instagram.com https://.cdninstagram.com https://api.instagram.com https://i.instagram.com https://.i.instagram.com https://.od.instagram.com wss://www.instagram.com wss://edge-chat.instagram.com https://.facebook.com https://.fbcdn.net https://.facebook.net chrome-extension://boadgeojelhgndaghljhdicfkmllpafd blob:; worker-src 'self' blob: https://www.instagram.com; frame-src 'self' https://instagram.com https://www.instagram.com https://.instagram.com https://staticxx.facebook.com https://www.facebook.com https://web.facebook.com https://connect.facebook.net https://m.facebook.com https://*.fbsbx.com; object-src 'none'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-IG-WWW-Claim: 0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: https://www.instagram.com/reel/CklbT3yDugv/embed/captioned/?cr=1&v=14&wp=540&rd=https%3A%2F%2Fcreativedestructionmedia.com&rp=%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F
X-Requested-With: XMLHttpRequest
X-ASBD-ID: 198387
X-CSRFToken: QfezgjmkDBNANMcqDUyzEwKc8SppNdLl
X-IG-App-ID: 936619743392459

Response headers

date: Tue, 27 Dec 2022 15:39:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: report-uri https://www.instagram.com/security/csp_report/; default-src 'self' https://www.instagram.com; img-src data: blob: https://*.fbcdn.net https://*.instagram.com https://*.cdninstagram.com https://*.facebook.com https://*.fbsbx.com https://*.giphy.com; font-src data: https://*.fbcdn.net https://*.instagram.com https://*.cdninstagram.com; media-src 'self' blob: https://www.instagram.com https://*.cdninstagram.com https://*.fbcdn.net; manifest-src 'self' https://www.instagram.com; script-src 'self' https://instagram.com https://www.instagram.com https://*.www.instagram.com https://*.cdninstagram.com wss://www.instagram.com https://*.facebook.com https://*.fbcdn.net https://*.facebook.net 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https://*.www.instagram.com https://www.instagram.com 'unsafe-inline'; connect-src 'self' https://instagram.com https://www.instagram.com https://*.www.instagram.com https://graph.instagram.com https://*.graph.instagram.com https://i.instagram.com/graphql_www https://graphql.instagram.com https://*.cdninstagram.com https://api.instagram.com https://i.instagram.com https://*.i.instagram.com https://*.od.instagram.com wss://www.instagram.com wss://edge-chat.instagram.com https://*.facebook.com https://*.fbcdn.net https://*.facebook.net chrome-extension://boadgeojelhgndaghljhdicfkmllpafd blob:; worker-src 'self' blob: https://www.instagram.com; frame-src 'self' https://instagram.com https://www.instagram.com https://*.instagram.com https://staticxx.facebook.com https://www.facebook.com https://web.facebook.com https://connect.facebook.net https://m.facebook.com https://*.fbsbx.com; object-src 'none'; upgrade-insecure-requests
x-ig-set-www-claim: 0
x-aed: 75
alt-svc: h3=":443"; ma=86400
content-length: 15
x-xss-protection: 0
pragma: no-cache
x-ig-request-elapsed-time-ms: 24
cross-origin-embedder-policy-report-only: require-corp;report-to="coep"
x-ig-origin-region: cln
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop"
x-ig-push-state: c2
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-language: de
access-control-allow-origin: https://www.instagram.com
report-to: {"group": "coep", "max_age": 86400, "endpoints": [{"url": "/security/coep_report/"}]},{"group": "coop", "max_age": 86400, "endpoints": [{"url": "/security/coop_report/"}]}
content-type: application/json; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
origin-trial: AuqWincgAuXeuu3KypEMnrrFEJHySaesyJS3EaIH40zvafzrU0Irhb7+5QwZpOqMZrPTjgvFl7Z5jJgy1dNAcQMAAAB6eyJvcmlnaW4iOiJodHRwczovL2luc3RhZ3JhbS5jb206NDQzIiwiZmVhdHVyZSI6IkNyb3NzT3JpZ2luT3BlbmVyUG9saWN5UmVwb3J0aW5nIiwiZXhwaXJ5IjoxNjEzNDExNjYyLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
x-ig-peak-time: 1
access-control-expose-headers: X-IG-Set-WWW-Claim
x-robots-tag: noindex
priority: u=1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK getuids Show response
prebid.adnxs.com/pbs/v1/ 3 B
368 B 197ms
45ms Fetch
text/plain 185.89.208.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/getuids
Requested by: Host: prebid.dblks.net
URL: https://prebid.dblks.net/ff/2659176.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.89.208.11 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: prebid.ams3.adnexus.net
Software: nginx/1.21.3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:35 GMT
Server: nginx/1.21.3
Vary: Origin
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://creativedestructionmedia.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 3
Expires: 0

GET
H2 200 delivery.js Show response
assets.revcontent.com/master/ 157 KB
50 KB 150ms
41ms Script
application/x-javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/delivery.js
Requested by: Host: prebid.dblks.net
URL: https://prebid.dblks.net/ff/2659176.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 3fdc364eeb75f7f4a1a581857d0c5f2719e89939d9dd63bfe154f798edb81ab8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:35 GMT
content-encoding: gzip
x-sp-metadata: HS256.CMe/rJ0GEocBCiQ1NDlhNzFjYS1jN2ViLTRhMjctOTc2OC1jMDQxNmM2NTdlNGQQwLnuqZCq+wIaBgi3o6ydBiIMODAuMjU1LjcuMTAyKOi+AjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiwIARIkNDI4NjcwMTQtN2ZiYy00YzRlLTljZGEtOTU4ZDBhMTE1NWJhGLeKAyIYCAISFGNkczE0Ni5mcjguaHdjZG4ubmV0.vzuxU03AHFkNe0WUNbLCAEoWCqKugJtoHVcBZUXsSnQ=
last-modified: Fri, 16 Dec 2022 17:47:02 GMT
server: AmazonS3
x-amz-request-id: PTW6WSD13QQVTWM8
etag: "f78c394118325a3686d52927a21f58d4"
x-hw: 1672155575.cds098.fr8.hn,1672155575.cds146.fr8.c
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=600
accept-ranges: bytes
content-length: 50487
x-amz-id-2: dk2I5IX/qUL+iX5Yr7hTKrgQ1ZVwEjWa2NFwSY7bCH9wFRXEbScQP7DSbHrxGf0J2Ko50T1u4LM=

POST
H2 200 / Show response
prebid.dblks.net/openrtb/ 3 KB
3 KB 134ms
133ms XHR
application/json 199.212.255.211
FHMNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.dblks.net/openrtb/?sid=2659176
Requested by: Host: prebid.dblks.net
URL: https://prebid.dblks.net/ff/2659176.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.212.255.211 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.14.1 / Express
Resource Hash: 8d55b6e9bdedfe8a90b42ae4d58ce585efa1fd1a69c734d6ed93698dd7ae20cf

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:35 GMT
x-openrtb-version: 2.5
server: nginx/1.14.1
x-powered-by: Express
etag: W/"c3c-49aLu2TNTVrsw28cuxk41WsfVw8"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: max-age=0, no-cache, no-store, private
access-control-allow-credentials: true
content-length: 3132

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/160835/4933/ 210 KB
65 KB 163ms
47ms Script
application/javascript 23.203.124.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.203.124.192 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-124-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 223fc8122a307637f83efd6b57fb96e0daf8795aaa98e431e83064efa65b4da3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:35 GMT
content-encoding: gzip
last-modified: Mon, 28 Nov 2022 20:34:20 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=85084
accept-ranges: bytes
content-length: 65523
expires: Wed, 28 Dec 2022 15:17:39 GMT

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame C4FC 141 KB
141 KB 465ms
200ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130843008387167&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 6e0a031ae4aa5bdbf71ab65b04a7ad39091da8a7bff77fcedc1ebf56f29e2146

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657836-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 144386
X-uuidno: 1440976065916071372

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame A410 143 KB
144 KB 419ms
154ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130866630707295&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 13a0bd0a77080ee8f4f5eafe583e470871b7654bd7e38b2838e9b03f226c3805

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657834-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 146515
X-uuidno: 1440977165427699148

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame 821F 138 KB
138 KB 404ms
140ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130890253027423&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: f7c370aec03546de5bb7531b8885578dfc3c53aab15401907c55dac988808dd2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657835-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 141170
X-uuidno: 1440978264939326924

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame 812D 103 KB
103 KB 452ms
190ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130913875347551&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: eb7a0b6dde6937dd421db9d96223766b25bbbee0076e64556f7bdd013faca65a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657831-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 105532
X-uuidno: 1440979364450954700

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame 3046 165 KB
166 KB 432ms
168ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130937497667679&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 140b3d4cbb8f59ea9f00ff0e3f94fe8202621d4ea2aa15372aaaf038d7d06db8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657833-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 169227
X-uuidno: 1440980463962582476

GET
H/1.1 200
OK /
s.dblks.net/i/15/ Frame B36A 118 KB
118 KB 443ms
179ms Image
image/jpeg 199.212.255.151
FHMNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.dblks.net/i/15/?fcid=130961119987807&mime=image/jpeg
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.212.255.151 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: ff224a5ed96fb61252e8fff7c45936e1afb981ae418b7cf5b0f7d7caf0644d9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:32 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
X-Fritter: 5.1-5.1-20221101.173631 hashx=12.3
X-Request: F657832-3/S0-0
x-first: mapped
X-Slot: 5573851
Content-Type: image/jpeg
Cache-Control: no-cache, max-age=0, must-revalidate, no-store, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 120753
X-uuidno: 1440981563474210252

GET
H/1.1 200
OK / Show response
trends.revcontent.com/api/demand/ 52 B
408 B 246ms
66ms Fetch
text/html 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/demand/?w=271025

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-99-81-25-188.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

8b4b43fd2629a9ae29c5220a852bbc8ff169c571cdf77798633efec65c934df7

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-RC-Region: eu-west-1c
Date: Tue, 27 Dec 2022 15:39:35 GMT
Strict-Transport-Security: max-age=931536000; includeSubDomains
Server: openresty
Content-Type: text/html; charset=UTF-8
access-control-allow-origin: https://creativedestructionmedia.com
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 52

GET sync
trends.revcontent.com/ 0
0

POST
H/1.1 204
No Content api-errors
yeet.revcontent.com/yeet/events/ 0
0 60ms
60ms Fetch 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/api-errors
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json

Response headers

X-RC-Region: eu-west-1c
access-control-allow-origin: *
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
Connection: keep-alive
vary: Origin

OPTIONS
H/1.1 200
OK api-errors
yeet.revcontent.com/yeet/events/ Frame 0
0 240ms
61ms Preflight 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/api-errors
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://creativedestructionmedia.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
X-RC-Region: eu-west-1c
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H/1.1 200
OK / Show response
trends.revcontent.com/api/delivery/ 30 KB
12 KB 197ms
196ms Fetch
text/html 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/delivery/?is_blocked=undefined&w=271025&width=1600&rev_allow_cookies=0&site_url=https%3A%2F%2Fcreativedestructionmedia.com%2Finvestigations%2F2022%2F12%2F22%2Fsuspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed%2F&icr_url=&va=0&user_uuid=undefined&time=1672155576024&up=pc&bn=chrome&bv=108&widget_width=760&style_id=0&idhub[pubcid]=0d583db4-e151-49dc-8fea-ad52eedc16d4&an=false

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-99-81-25-188.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

e0b4f1f743985070019e0398c164d4f3cbf5b51db6bedc52873bbe9504ceb2bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

X-RC-Region: eu-west-1c
Date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=931536000; includeSubDomains
Server: openresty
vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
access-control-allow-origin: https://creativedestructionmedia.com
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 12171

POST
H/1.1 204
No Content impression
trends.revcontent.com/event/ 0
0 228ms
61ms Fetch 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/event/impression

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-99-81-25-188.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-RC-Region: eu-west-1c
Date: Tue, 27 Dec 2022 15:39:36 GMT
Strict-Transport-Security: max-age=931536000; includeSubDomains
Server: openresty
access-control-allow-origin: https://creativedestructionmedia.com
access-control-allow-credentials: true
Connection: keep-alive
access-control-allow-headers: Content-Type

GET
H3 200 css2
fonts.googleapis.com/ 6 KB
716 B 46ms
46ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&family=Ultra&family=Vollkorn:wght@400;600&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ccd3bbf4e4e6d85aa636703e6b470e8837afac62d84cd78a2989f3c7c05d6951

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Dec 2022 15:39:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Dec 2022 15:39:36 GMT

GET
H2 200 brandWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 65 KB
17 KB 45ms
44ms Script
application/x-javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/brandWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 0cb22db86fd281150ddd6bbf814d246682cb2f190d6f611fc708a1a9bcd6342c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
x-sp-metadata: HS256.CMi/rJ0GEocBCiQ4NGZkMTg1Zi0yM2RlLTQxM2MtOGVlZi1iZjc0MmIwOWNlZTEQwLnuqZCq+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKOi+AjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiwIARIkOTFiNTc0ZTgtNTI3NS00ZDYxLTlhMjItNjhmOGUyNjcwOGNiGOiEASIYCAISFGNkczI1NC5mcjguaHdjZG4ubmV0.dFpIhv9TAB93JWwgv55FLbHEWMPx8jCuQBGcp/oInhM=
last-modified: Fri, 16 Dec 2022 17:47:03 GMT
server: AmazonS3
x-amz-request-id: PTW72A0M9PPBGK41
etag: "5468c11eb19d0dff2cc2a1254f159895"
x-hw: 1672155576.cds098.fr8.hn,1672155576.cds254.fr8.c
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=600
accept-ranges: bytes
content-length: 17000
x-amz-id-2: Yz9yMf5NDI/YhzVyC/yRK6CY5QqGwuzzweAsfSrXc79CcdEJwBfvvXGq8jYbMG1Ayk8jQTb6FaA=

GET
H2 200 defaultWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 23 KB
7 KB 45ms
44ms Script
application/x-javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/defaultWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 835e347cd1bf6ccfdbcf9fd51249ddc375bee11dcc3d1e175d24de2479cb9867

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
x-sp-metadata: HS256.CMi/rJ0GEocBCiQwNGZiY2I3YS01ZmY0LTRjYmEtOTBkNC00YmYzZGRlNTE5N2IQwLnuqZCq+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKOi+AjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkMDVmNTQyMDItYTkxOS00YzM0LThhZTQtZTNmY2UzYTU2M2JlGPs2IhgIAhIUY2RzMTU0LmZyOC5od2Nkbi5uZXQ=.pXpMyNnawVR7sS8f657NVv3s2iGIYneweMEJ4QLsLic=
last-modified: Fri, 16 Dec 2022 17:47:06 GMT
server: AmazonS3
x-amz-request-id: PTW2HE2G5EBA098T
etag: "e809cab7155c5e2274f446babe344a3f"
x-hw: 1672155576.cds098.fr8.hn,1672155576.cds154.fr8.c
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=600
accept-ranges: bytes
content-length: 7035
x-amz-id-2: YYmPD9qoMSQaT7PekX6IHmaXR6N/fDvCMs5DSs5IVUVM8oiP7hGObfF62XHRzla++RFJ58cqF6c=

GET
H2 200 feedWidget.delivery.js Show response
assets.revcontent.com/master/ 30 KB
9 KB 56ms
56ms Script
application/x-javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: ac28c5d29cc4ad0e9136c4f26bcc6c58f33b6852a874297ecd1367c1ba7d4eca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
x-sp-metadata: HS256.CMi/rJ0GEocBCiRiNjc4ZmMxNy02YmZhLTQyYjItODM5MC0xODI1MDg3NTUxMjUQwLnuqZCq+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKOi+AjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkZjYwNGNkMGEtNTRiMi00Mzg2LThlNTMtMDIwMjc0MjFhMDgwGLtHIhgIAhIUY2RzMjY2LmZyOC5od2Nkbi5uZXQ=.rzj2DFTVIefSt8pcyHylqZs4AqCjYgdqGmO5byDEzkk=
last-modified: Fri, 16 Dec 2022 17:47:04 GMT
server: AmazonS3
x-amz-request-id: PTW3FK24WY12A5HQ
etag: "d1a70ad434ab1ea8e2577d8a09e6875c"
x-hw: 1672155576.cds098.fr8.hn,1672155576.cds266.fr8.c
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=600
accept-ranges: bytes
content-length: 9147
x-amz-id-2: YMHAkyJzuH7Nx7DCHku/gkZeX3C8jnlqCiuTxTn+xa8SxI89IH/9keC+LwSOfWQ4utd8p9ejUxQ=

GET
H2 200 commonModal.delivery.js Show response
assets.revcontent.com/master/ 3 KB
2 KB 53ms
53ms Script
application/x-javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/commonModal.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 521cc807c765916486d3c1258f5552a182cc1b5f572ba9a83c818fddccee9675

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
content-encoding: gzip
x-sp-metadata: HS256.CMi/rJ0GEocBCiRlYzg3NThiNS1iODMxLTQ1ZTQtYmU5OS05ZmNiNWUyMTdmM2YQwLnuqZCq+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKOi+AjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkYzlkYjdiNzgtNzIyZi00OGIwLWE1ZWMtYmY3NzVlMTE1ODUxGP4MIhgIAhIUY2RzMDAyLmZyOC5od2Nkbi5uZXQ=.hTGimn0vm5kydJmCWQoMhAF5fLEGA0azmtvQa7Z9mcU=
last-modified: Fri, 16 Dec 2022 17:47:04 GMT
server: AmazonS3
x-amz-request-id: PTW75XD9GEMTEPJX
etag: "4bd0e667cb75952eacaaafc57c64ebee"
x-hw: 1672155576.cds098.fr8.hn,1672155576.cds002.fr8.c
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=600
accept-ranges: bytes
content-length: 1662
x-amz-id-2: 9x+4dbR9k4Vb9pPrueFEkOEhxgOgOCNV95777KJfoGV7aUOyfuy+tp+hBpzabNzK3MpOWx5du1g=

GET
H2 200 /
img.revcontent.com/ 1 KB
2 KB 172ms
42ms Image
image/png 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.revcontent.com/?url=https://cdn.revcontent.com/assets/img/full_color.png&static=true
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
x-sp-metadata: HS256.CMi/rJ0GEocBCiQzYjI4NjViOC1kNjZmLTQzNDktOTRhZC0wMzkxMzgyNjQ2OTMQoL/IhabZ+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKO7AAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkNjcxOGVjZTYtYjExNi00ZTYwLThjYzgtZTQ3ZmM5NTk5MGFkGMcKIhgIAhIUY2RzMjYwLmZyOC5od2Nkbi5uZXQ=.zemk6tFiqyqaCx5qcmrWWtOBP8ynobqb4L5PhpNlWtc=
last-modified: Thu, 02 Jun 2022 15:22:42 GMT
etag: "1654183362"
x-hw: 1672155576.cds214.fr8.hn,1672155576.cds260.fr8.c
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1351

GET
H2 200 rc-logo.png
cdn.revcontent.com/assets/img/ 2 KB
2 KB 137ms
40ms Image
image/png 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.revcontent.com/assets/img/rc-logo.png
Requested by: Host: creativedestructionmedia.com
URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: f4241710e57486ad91102e31823e855469608e1aea362f1f0e059609c9eb9a56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
x-sp-metadata: HS256.CMi/rJ0GEocBCiRkNDNiNWMyZi03MjZjLTQwMTEtOWFhNi0zNzZhMzlkMGMxM2MQyLfx1Yuh+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJjBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkMWNjMmEwZGMtNzlkZi00YTk3LTg0MTMtYzU0NGMxMmNlYmRjGKsQIhgIAhIUY2RzMDU3LmZyOC5od2Nkbi5uZXQ=.8nKC6DzJyr+5zsQjIqG63m7nFToNOAPxecnvRJght2o=
last-modified: Thu, 22 Dec 2022 21:15:29 GMT
etag: "1671743729"
x-hw: 1672155576.cds011.fr8.hn,1672155576.cds057.fr8.c
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=861
accept-ranges: bytes
content-length: 2091

GET
H2 200 63877d26b55a49-33088013.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 6 KB
7 KB 165ms
49ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/63877d26b55a49-33088013.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

3a3be08a78b019b0ee92257ea3233a08c453ba41cad584d8c07df641c7fe772b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=18;cpu=0;start=2022-12-01T10:24:56.169Z;desc=hit,rtt;dur=0
content-length: 6579
x-request-id: b6b27b0583b5b9c2fcebe9366b7f5c90
x-sp-metadata: HS256.CMi/rJ0GEocBCiQyYjhlNDAyOC1jNGMzLTRiMmEtODIwYi1mODcyN2Y4NzZiNzgQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkNGM4MDFhOTEtNDY5OC00MjA4LThhZTktYTE3NjFiYmQ4NGVmGLMzIhgIAhIUY2RzMjU4LmZyOC5od2Nkbi5uZXQ=.jzoAyVPjWGFyfkwAEIAMJS58H/KLKdaaGxdh6mfGnzc=
last-modified: Wed, 30 Nov 2022 15:57:50 GMT
server: Cloudinary
etag: "109c7179cc875988476e90bbd507c491"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds258.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 6387213dacb191-99096497.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
7 KB 168ms
56ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/6387213dacb191-99096497.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

14358cfcabb3e5ce7ce1afe2932cf94a00a3697d6a9aeebe88be6eb68eb37d99

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=2;cpu=0;start=2022-12-12T07:23:08.581Z;desc=hit,rtt;dur=0
content-length: 6792
x-request-id: 9c09c3441f5e497a9458ca7be1079f32
x-sp-metadata: HS256.CMi/rJ0GEocBCiQ1ODYxMmQzZC02NThiLTQ1ODktODVjNi1lYjY1YWU5MDhjN2YQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkN2ZlM2RlNmMtODFkYS00MDczLWJmOGMtODc0ZDlmYjJiMmUyGIg1IhgIAhIUY2RzMjI0LmZyOC5od2Nkbi5uZXQ=.E68Djpo44szDs9rR4Ec2KhdyHuXrJE41G4JkBeJyIIQ=
last-modified: Wed, 30 Nov 2022 09:26:04 GMT
server: Cloudinary
etag: "dac52a798d600eacb2de4103dbd20b31"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds224.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 63a136a86d8ae0-08885244.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
5 KB 182ms
74ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/63a136a86d8ae0-08885244.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

07759364dcd1575959453850bf12d822b800ab6a3b5c5ec00583f9ed804b0190

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=4;cpu=1;start=2022-12-22T16:22:20.769Z;desc=hit,rtt;dur=0
content-length: 5062
x-request-id: 938da88a15f53aacafb8de77072ab657
x-sp-metadata: HS256.CMi/rJ0GEocBCiRlZDAxZWY1Mi1iNjEzLTQwMjEtYTM2MS1iMmY2YzMyYTBjNGMQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkYjE5NGQ2ZWMtMmIyMy00NTM5LTk2NGEtMzI3NjI0NGE3NWM4GMYnIhgIAhIUY2RzMjMxLmZyOC5od2Nkbi5uZXQ=.JGBGNVW7oNKhMfRpzvvxj6obHk4E1rMHvqGq/0mb7is=
last-modified: Tue, 20 Dec 2022 04:15:41 GMT
server: Cloudinary
etag: "6612e44263f62d5948d501e8f320daf2"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds231.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 c9b6e5a7ed46b1408ba62a3c38a138a9.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 6 KB
7 KB 179ms
75ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/c9b6e5a7ed46b1408ba62a3c38a138a9.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

44267e9c2bfeccbe597ba228a32a4b23d9dba49016037bda5e9b6368f1f24961

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=1;start=2021-12-28T18:27:31.087Z;desc=hit,rtt;dur=0
content-length: 6479
x-request-id: 108d9374403b28db4f2df069c2520c2b
x-sp-metadata: HS256.CMi/rJ0GEocBCiRiNmRlYmY1Zi1lZjQ5LTQ3NTMtYmZjOS1mMWFiOGM0NDA5MDEQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkYzVlYzRmZjctMWRhNS00OTM4LWFkNjItZWVmNGZkYTY3Nzc1GM8yIhgIAhIUY2RzMTY1LmZyOC5od2Nkbi5uZXQ=.HKVnTEpZdErCcNpbBD93w/FNvR9cz169HnKZph13JOk=
last-modified: Tue, 28 Dec 2021 17:57:25 GMT
server: Cloudinary
etag: "1dd46bfd3a5f9ea37dc3580f69d33939"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds165.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 6179e9dfddde76-18821747.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 9 KB
9 KB 189ms
90ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/6179e9dfddde76-18821747.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

3539e71564ed1010478020e559b88b87b3d72245ecccdad41de7b9d25d1ee788

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=1;cpu=0;start=2021-12-02T06:15:51.895Z;desc=hit,rtt;dur=0
content-length: 8933
x-request-id: c2f7dc71ed72bf39733374a194aaad2b
x-sp-metadata: HS256.CMi/rJ0GEocBCiQzYzEzOGJiOS1kYWYyLTRiZTMtYjA0MC02NjIzZjkyMGE0NDgQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkNzI1ZmFkZGYtYTA4Zi00YTNmLWFjZTYtYzRkOGQyZTkzMTJkGOVFIhgIAhIUY2RzMjE1LmZyOC5od2Nkbi5uZXQ=.3isH2RYaVekn+aGnn/5SfvScXzHWXhSgbzABZAZmzI8=
last-modified: Thu, 28 Oct 2021 12:08:30 GMT
server: Cloudinary
etag: "0fc321693ae863bbdcdd10e033749a81"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds215.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 638d8b5419f983-74608455.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 181ms
85ms Image
image/jpeg 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_50,h_225,w_300,c_fill,g_face:auto/pg_1/https://media.revcontent.com/content/images/638d8b5419f983-74608455.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map3.hwcdn.net

Software

Cloudinary /

Resource Hash

3840e516d88d341ed80ffb6533bb634866fd084423144b6941c6a0ed8e75fd1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
server-timing: fastly;dur=2;cpu=1;start=2022-12-05T07:18:48.725Z;desc=hit,rtt;dur=0
content-length: 5560
x-sp-metadata: HS256.CMi/rJ0GEocBCiQzZDQxZmMwYS1lOWE1LTQ4MGItYjhjMC0zNzU2MmRkNmUzMDMQmMGs1q3Z+wIaBgi4o6ydBiIMODAuMjU1LjcuMTAyKJrBAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkZmJiZDExNzQtMWQyZi00MmY4LWIwZjEtY2M4NmM2NzdhN2Q5GLgrIhgIAhIUY2RzMDA2LmZyOC5od2Nkbi5uZXQ=.DXWbY8qCp1NY1exMWEVGaCaMpLhHnFMiiQcJ6YJZ/SU=
last-modified: Mon, 05 Dec 2022 06:46:28 GMT
server: Cloudinary
etag: "bfc511a6e62a801ab0299ed5edfd3587"
x-hw: 1672155576.cds279.fr8.hn,1672155576.cds006.fr8.c
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 07.02_%E7%B8%BD%E7%B5%B1%E5%B0%88%E6%A9%9F%E8%BF%94%E5%9C%8B%E6%99%82%E7%A9%BA%E8%BB%8D%E5%B9%BB%E8%B1%A1%E6%88%B0%E6%A9%9F%E5%89%8D%E5%BE%80%E8%BF%8E%E6%8E%A5%E4%B8%A6%E8%AD%B7%E9%80%81%E8%BF%94%E...
creativedestructionmedia.com/wp-content/uploads/2022/12/ 9 KB
9 KB 47ms
46ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/07.02_%E7%B8%BD%E7%B5%B1%E5%B0%88%E6%A9%9F%E8%BF%94%E5%9C%8B%E6%99%82%E7%A9%BA%E8%BB%8D%E5%B9%BB%E8%B1%A1%E6%88%B0%E6%A9%9F%E5%89%8D%E5%BE%80%E8%BF%8E%E6%8E%A5%E4%B8%A6%E8%AD%B7%E9%80%81%E8%BF%94%E5%9C%8B_28036481176-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5f4b357ed7ae2404c777593555eb31ce085752d81e1462b916ae3fd331954c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 23 Dec 2022 16:13:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=45DPN4IReG4iO6SPPVtdYeTiPsFNW8kP9M3Vm9K8jPPNKaT0fkIzUMNfrHr%2F7UJcfgAHLb3zwnCvu7uhHVT%2FvLxufckYlqZl3BQ5q%2FnS0sZoGlkXdrHbgzN25tBkCiWDb6Av3U0aLIJAvYK7AiyQLZIU79nf5J7%2FIERA"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661a9f6996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8783

GET
H3 200 Iranian_drone_exercise_in_2022_-_Day_2_33-280x186.jpg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 9 KB
9 KB 87ms
84ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Iranian_drone_exercise_in_2022_-_Day_2_33-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be201fb63f76d14aafe69b386631b37dcb4b3e3448f48a7486f27f8ee191f3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Dec 2022 17:54:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DoKuDwONkt8mXDILbIbXAiKU%2BrpERZW7F7UgnSfW67TIQ64wxjqFWelAzJNqMUWKFjXnHin39tv97vRBtI%2FXLLJNYSkB7EmWq%2F6aF%2FH35UA00v%2Bjg4jxZWwG7TwpnNUs4VILrsCqNpsFrStdJIg6HNXyu8ElsakmwzTA"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661a9fc996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9155

GET
H3 200 a-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 106 KB
106 KB 49ms
46ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/a-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e1bd585900a6c5f23119bd9411c4e4030e3d1d3fa9e992a2d5186c1fb4ff689

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Sun, 18 Dec 2022 04:26:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XUpq8pBBP1GsZF4Wr0HHoZE7hGYcwdhI2Kp6SK5It%2FNUcYUV5xe1rag1hNPgyELGaimaBYP6lfGuOLQQ0ea6ajWhEzBX9N%2B55N71jI2bTpQJfpRIjVKMdj4gcdLiv9bc4MdzYcacZogvg0%2FjtP%2BHiC5pRh8YX8vJUOoX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661a9fd996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 108418

GET
H3 200 H-6M_81218_20150730-280x186.jpg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 5 KB
6 KB 47ms
45ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/H-6M_81218_20150730-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a1c659bed192059b4eaefde30f39c40be49f5c466d8c9f1c95c78d3c13f3e22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Thu, 15 Dec 2022 15:33:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TFEnSv6QQcvgAnkkXeCy%2BrYVPxh%2BPZO4BnxY43V%2Bt4TG27A9M4w9FY7Kbl8TpeLpvIDp2cAsA7Q70sTe5YjhDMwyGPISWTsV%2Br9FN7RGBEESd3uBJii46a%2BEvBRpFgF4L3C52a0Ypun5tJigu7aPNVdZP8bHNjyplu02"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661a9ff996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5438

GET
H3 200 r-2-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 64 KB
64 KB 84ms
81ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/r-2-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60ef0341dc54e4cebc339e7f09e0f54ab87f85aba0d839aecf21c518955bbd3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Sun, 25 Dec 2022 16:37:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=05AkLerUCweTA12lIqi4gC%2BpPERmf9jMr2rPwm2szc92ByS1ajXGLAcetzY%2FNgGywt7zYbqyOFxDLXg4QjVcklYcPP9R1a%2FImwChpD0EEQWs7xyXAMqbPr1hsOoz%2BZrOdmCkbs5wl910mdksxMk%2BFKQRy4jHUSJUPoLZ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa01996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 65030

GET
H3 200 Screen-Shot-2022-12-22-at-2.15.34-PM-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 149 KB
149 KB 88ms
86ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Screen-Shot-2022-12-22-at-2.15.34-PM-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15594c9df39e77821918e374f726a7ab387d4a734c6b9cedfd927cbe9a32e89d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Thu, 22 Dec 2022 19:17:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gVpYpnejDemtN81KQEbgelGbC%2FHPNUPwJcJetRCuviqt49SERs1gl0U3jC0qgW7UTPZHC%2FsEeH6SIavg2jDhojzi9KHG%2B4QXGAETOMbQYgSjGF3xHxsnGLtJYP7e3HpVl67CZSyj0sSZ1r3hqXpQNrh%2F9W8VIMV0ID2v"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa02996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 152354

GET
H3 200 tw7-1-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 93 KB
94 KB 49ms
47ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/tw7-1-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acf3f18d32ec0e6d987ef5adca6826834b664ee393a1ba2130f68797dca3acb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Tue, 20 Dec 2022 02:11:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=snR6qo3k%2BAcSP2zy6QY95g7C37m4TLtzxymFDdmggBkdHvVtt7iexrd47jiS1fvakhJiat9x4X9WrKHODxxb79F%2FbctSKPuNvXYTyQZSOr%2Fxs%2FFv5EYNF0w%2BXUYksxWRBekfpCLmPqgGmrlNqcPYbqtCKtMAQvxeRIpk"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa03996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 95694

GET
H3 200 k-280x186.webp
creativedestructionmedia.com/wp-content/uploads/2022/12/ 3 KB
4 KB 126ms
124ms Image
image/webp 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/k-280x186.webp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c807d0aea213a02abccdbddb53e6c465caa8cd8c1d8a4d6d24d94d681847a39c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Dec 2022 23:16:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9qV5bQHBBbvjafVDmoBtfqfQtWdEKxpPBhcIq6F6ydXplf5wqnI88g8iiRzqN9BaJ9GHrI8nLdfbK2a1xCqW1MDwL1jisKfNe6nsE9e2bwh0VRcSImxYT%2B2Sm9JrQaWf5ilewusT0pt%2FVMAFiYZ3A9%2Ft2pR3EvngSuUF"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa05996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3470

GET
H3 200 Beverly_Hills_Board_of_Education-280x186.jpeg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 12 KB
13 KB 127ms
125ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Beverly_Hills_Board_of_Education-280x186.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce561d824696efab70ddcd9dcbc3fe4e8e688851e6bea4e121cd9837323ef3eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Dec 2022 16:32:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d2BdmULBfxVWwxotUW%2FKTLkqWCuA3sUvIoUToSoWhwxa%2BkxqyAI3MqQzVqS%2F7KuNggaLkuFMocmpFsuoBgt57CS%2F7edam8wnwNwWDD0aeSQmRN4Qq0%2F4YJm8bIWSnU0yMnZsmTOr20uvMS5VD6TDubE2stTut2MDNfBp"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa06996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12643

GET
H3 200 v-280x186.webp
creativedestructionmedia.com/wp-content/uploads/2022/12/ 14 KB
14 KB 128ms
126ms Image
image/webp 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/v-280x186.webp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef65d4be75ed748d868a0f1bce0527f6d7d17ef4ec3fd68d4c253f3fae85a1ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Mon, 26 Dec 2022 15:36:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ojpJrJ53Z4o01aU3mRB2b3Q6nOs2AmRQcM96Rm7TBCZQf5jPhgqhV6vHf1lC%2BR4QFoXqOXhMQPaSKnqAaXxAkNtEbrl8tFqSWTOtSMpZWLw%2FURaJN84sboxP1hQF2x5go7CNm1H%2BiWt6%2FXjh%2BfxEdPO%2FH4EsmyGkch9d"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa08996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13982

GET
H3 200 f-3-280x186.jpeg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 10 KB
10 KB 83ms
81ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/f-3-280x186.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85f51306e8210bda2fee4a6f9ac5ceab89a7ae7ec1d9e00eaaf45515ce8be680

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Dec 2022 15:14:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ve2bzC2vjWuLXBtzZ%2B3%2BV6ayEHCly79vCKci5Ecyf9xWfb5FoJuWIo%2FcY%2FNX%2BiUEc44dgnE40jak%2B4sg6EaNi%2FTehsYpq5tKqQiCpPr5gNp9wNzAPl1k%2F0prfdDb1MzQrabC5Ww59iw1N5%2FY9hm1VAihpsiSduNB5BnJ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032661aa09996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10121

GET
H3 200 07.02_%E7%B8%BD%E7%B5%B1%E5%B0%88%E6%A9%9F%E8%BF%94%E5%9C%8B%E6%99%82%E7%A9%BA%E8%BB%8D%E5%B9%BB%E8%B1%A1%E6%88%B0%E6%A9%9F%E5%89%8D%E5%BE%80%E8%BF%8E%E6%8E%A5%E4%B8%A6%E8%AD%B7%E9%80%81%E8%BF%94%E...
creativedestructionmedia.com/wp-content/uploads/2022/12/ 9 KB
9 KB 107ms
106ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/07.02_%E7%B8%BD%E7%B5%B1%E5%B0%88%E6%A9%9F%E8%BF%94%E5%9C%8B%E6%99%82%E7%A9%BA%E8%BB%8D%E5%B9%BB%E8%B1%A1%E6%88%B0%E6%A9%9F%E5%89%8D%E5%BE%80%E8%BF%8E%E6%8E%A5%E4%B8%A6%E8%AD%B7%E9%80%81%E8%BF%94%E5%9C%8B_28036481176-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5f4b357ed7ae2404c777593555eb31ce085752d81e1462b916ae3fd331954c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 23 Dec 2022 16:13:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vy2sLQk8BCaheXShWg5ujXDgaZIgxr7T7QF45iCneozLcS5GQdTFJtzvtO2bJEF7L9krGOPpCjnQoCUaxFEA3fk%2FHObw5ss6oFN4ONMxlJEzZUStMvA0LL24IvFeFFWVRRMZnDc159R21Yuk%2FxeZKBycaVRY4toxeUhy"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326620a7c996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8783

GET
H3 200 H-6M_81218_20150730-280x186.jpg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 5 KB
6 KB 106ms
105ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/H-6M_81218_20150730-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a1c659bed192059b4eaefde30f39c40be49f5c466d8c9f1c95c78d3c13f3e22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Thu, 15 Dec 2022 15:33:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fa%2BZPASqoGcjo0d4X1wkUK2nHG8lpPF%2ByBCEYddMV9cMUI4e%2FCZD9wCThvdtHdac%2BvXWPswGYrRqOg8QMTURYmAP9JN%2BNInmp5PGyDZ59E136bwKGVlE7FU9Oo9HpeXxvocMnfdwjBLzkEsQeZcP2iuDg%2F71S9Tf5fvK"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326620a80996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5438

POST
H2 204 / Show response
prebid.dblks.net/a/pb/ 0
231 B 125ms
124ms XHR
text/plain 199.212.255.211
FHMNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.dblks.net/a/pb/
Requested by: Host: prebid.dblks.net
URL: https://prebid.dblks.net/ff/2659176.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.212.255.211 , Canada, ASN25948 (FHMNET, CA),
Reverse DNS
Software: nginx/1.14.1 / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
x-openrtb-version: 2.5
server: nginx/1.14.1
x-powered-by: Express
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: max-age=0, no-cache, no-store, private
access-control-allow-credentials: true

GET
H3 200 a-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 106 KB
106 KB 73ms
72ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/a-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e1bd585900a6c5f23119bd9411c4e4030e3d1d3fa9e992a2d5186c1fb4ff689

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Sun, 18 Dec 2022 04:26:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZMbf%2BYhZjyNqbv2WIcqF6yYbz%2FQAlbGWs6bT8Wo0cByEl6B4kRzAfJjxqkbFKFMiXrp3%2BT8ncshniozCiFAKAJqJtf%2Fajz0eJqUFIEJVGwLt6PvBmDw3fC4utUWdej5IIJ9hmw3LUzTqv9RikD78U2Mi%2FTPWj2bVWI60"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326624b0b996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 108418

GET
H3 200 r-2-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 64 KB
64 KB 73ms
73ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/r-2-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60ef0341dc54e4cebc339e7f09e0f54ab87f85aba0d839aecf21c518955bbd3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Sun, 25 Dec 2022 16:37:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kaLORWPr3mtLjq9MTktMXvSVADc7KOHEnJZS7OgfWykGPCGYJQI3dp0AgnkNMohxvXVva92r96jZnJgjhx%2FBWW6sVVHrMx2TAO7XXhkcWfXEQadRbtodLiaGMxlE11fed%2BFd55ja6yrnjae2k3puVU77a%2F%2BbX0g3zNLQ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326624b10996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 65030

GET
H3 200 Iranian_drone_exercise_in_2022_-_Day_2_33-280x186.jpg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 9 KB
9 KB 73ms
73ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Iranian_drone_exercise_in_2022_-_Day_2_33-280x186.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be201fb63f76d14aafe69b386631b37dcb4b3e3448f48a7486f27f8ee191f3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Dec 2022 17:54:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z324zw2AmUQbYp%2BIr0xkBW6cHvV6F9CHr3VBhNDXpIDDsK15W1M4qSH75fnQJJ0UxEFxYboa866Qm89%2Brz%2FK0JNJ0O4KiiX2g6weBY1F2pqBT5CW6zPsyEUedRJCpOCOKNDcgoBDn38VYyT7nJcZ1rbSJilPlyjkft3f"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326624b12996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9155

GET
H3 200 Screen-Shot-2022-12-22-at-2.15.34-PM-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 149 KB
149 KB 51ms
50ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Screen-Shot-2022-12-22-at-2.15.34-PM-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15594c9df39e77821918e374f726a7ab387d4a734c6b9cedfd927cbe9a32e89d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Thu, 22 Dec 2022 19:17:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pBAgwi%2F45oh8FJbK7uEbjrEmbX4YNo9g14cIxhW6FNQ26tzsjWxIgZ2yaPOfy9spA5JRtL0Q9vNYkWIPOsz3uiX7nxyPzRiYtK%2F817OvcNrO9CZ85ViR2XFt%2F1Qt89lk3PtTIOINGTuAUg6jUkCz1gADYi12ryFIxZkL"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326627b55996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 152354

GET
H3 200 tw7-1-280x186.png
creativedestructionmedia.com/wp-content/uploads/2022/12/ 93 KB
94 KB 74ms
72ms Image
image/png 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/tw7-1-280x186.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acf3f18d32ec0e6d987ef5adca6826834b664ee393a1ba2130f68797dca3acb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Tue, 20 Dec 2022 02:11:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UoRxc2ArHyYP5zR1uNN4HqoYoC9CUdwOE9l2NUojH7bLmBy%2Fqcg%2BvTjG1BTR2dbd%2F4ov%2B8inI%2Fg5oPk5cTK5kV5sNGUhG5q2w0w9dQXoFCDvYLiax92xoH8C2wMJqSYUCW5BLjCxwuMoV2xon6nPayre7CD3wWy6yees"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326627b67996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 95694

GET
H3 200 k-280x186.webp
creativedestructionmedia.com/wp-content/uploads/2022/12/ 3 KB
4 KB 72ms
72ms Image
image/webp 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/k-280x186.webp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c807d0aea213a02abccdbddb53e6c465caa8cd8c1d8a4d6d24d94d681847a39c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Dec 2022 23:16:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=obbpT7eOG2o9I9laOTYPRfd6imJKgBZ3PtSv3kVeczQjAcpltbeF2pGnogmiYZ1vuYOyXxlYH%2F6ZJoE0Wel1UzxZNRzMAjH%2Fj9Klvp1%2Bi%2FkyZ%2FNyhti%2BzKJNNEJN1prHL6KIF%2FQvyUG5Pr9zBRGCHuhGUx9tswJjAYvz"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326628b78996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3470

GET
H3 200 Beverly_Hills_Board_of_Education-280x186.jpeg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 12 KB
13 KB 73ms
72ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/Beverly_Hills_Board_of_Education-280x186.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce561d824696efab70ddcd9dcbc3fe4e8e688851e6bea4e121cd9837323ef3eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Dec 2022 16:32:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIB21MG0kRxptkKzkZsesDERkk0j8Dm8xNGqfDdiI3nIhghA6Kzx9qe3504%2BvA6k9L2wkX4PLwReGHbgeK2UBcVoDJ%2FzfsF2qROaelxEh82nRzhAb86VjwKbWKStnTq57%2F1xacuPK9AZzx%2F1J4shv4YSMN92tkBDM7AR"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 780326628b79996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12643

GET
H3 200 v-280x186.webp
creativedestructionmedia.com/wp-content/uploads/2022/12/ 14 KB
14 KB 73ms
72ms Image
image/webp 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/v-280x186.webp
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef65d4be75ed748d868a0f1bce0527f6d7d17ef4ec3fd68d4c253f3fae85a1ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Mon, 26 Dec 2022 15:36:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BmLqnYqUSw8TSUJFpU47uJ2xyvnH%2BubDEpfqYO3yI%2BRdK9nznLUmaP1ADqjRIinDaJtwq7yN5Cvb5Py9tF3qRHsmVXwnhzD3ccLlROk5fbqzTSMa7Ms2mCHjld9o4v1L%2FOTgrhrF0rdFkBeFt1njkiAjaSjIY9i%2BAnvO"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032662abaa996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13982

GET
H3 200 f-3-280x186.jpeg
creativedestructionmedia.com/wp-content/uploads/2022/12/ 10 KB
10 KB 73ms
71ms Image
image/jpeg 2606:4700:3030::ac43:bfc6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://creativedestructionmedia.com/wp-content/uploads/2022/12/f-3-280x186.jpeg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:bfc6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85f51306e8210bda2fee4a6f9ac5ceab89a7ae7ec1d9e00eaaf45515ce8be680

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:36 GMT
cf-cache-status: HIT
last-modified: Wed, 21 Dec 2022 15:14:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3480
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJXlfxGy9dPttyNu4dkNB5ilCsP7hrHSz0hCF0GufUtiEOL0btS1S%2BZIec4mwHAXpG%2FrwtSJ6oj4VwdKqIyK246p%2BX6B18pZ8bCaS5hNqPdTCLWtM8ViFJq0ee8dUaaHli4t4HN22S3204IBCiW9EAH%2F9QJ6CO%2BH6Y8G"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78032662abb0996f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10121

OPTIONS
H/1.1 200
OK page-view
yeet.revcontent.com/yeet/events/ Frame 0
0 62ms
62ms Preflight 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://creativedestructionmedia.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
X-RC-Region: eu-west-1c
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

OPTIONS
H/1.1 200
OK widget-loaded
yeet.revcontent.com/yeet/events/ Frame 0
0 126ms
64ms Preflight 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://creativedestructionmedia.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
X-RC-Region: eu-west-1c
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

POST
H/1.1 204
No Content page-view
yeet.revcontent.com/yeet/events/ 0
0 125ms
60ms Fetch 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json

Response headers

X-RC-Region: eu-west-1c
access-control-allow-origin: *
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
Connection: keep-alive
vary: Origin

POST
H/1.1 204
No Content widget-loaded
yeet.revcontent.com/yeet/events/ 0
0 109ms
75ms Fetch 99.81.25.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.25.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-25-188.eu-west-1.compute.amazonaws.com
Software: openresty /
Resource Hash

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json

Response headers

X-RC-Region: eu-west-1c
access-control-allow-origin: *
Date: Tue, 27 Dec 2022 15:39:36 GMT
Server: openresty
Connection: keep-alive
vary: Origin

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 145ms
48ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreativedestructionmedia.com%2F&domain=creativedestructionmedia.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://creativedestructionmedia.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 27 Dec 2022 15:39:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 369290
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
258 B 779ms
385ms XHR
application/json 2600:1901:0:8344::

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0013300001kQgaMAAS&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:8344:: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:38 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreativedestructionmedia.com%2F&domain=creativedestructionmedia.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=Whv-0HxPSllzUEdpRTU1eEJhUmRTTmVLbm9BSU83Zk9XaW9oeTlpY1A3WG5ZL1JXMUVFQTA0bUYzMTlTc2MyVFVXaWdCNkRLc1JIRCtQUVJFQ0w2RmtabzNvN29DbitWQ3dvQVAxVGFHa0EvNTh6L0c1RjFZUmdCampDbH...

439 B
725 B

138ms
46ms

XHR
application/json

178.250.0.157

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=Whv-0HxPSllzUEdpRTU1eEJhUmRTTmVLbm9BSU83Zk9XaW9oeTlpY1A3WG5ZL1JXMUVFQTA0bUYzMTlTc2MyVFVXaWdCNkRLc1JIRCtQUVJFQ0w2RmtabzNvN29DbitWQ3dvQVAxVGFHa0EvNTh6L0c1RjFZUmdCampDbHU2amNzY09aRjArNkhCeWpJSUtEcVlEQmxleUczTWFvYXI2d2hCUk40UjlEUjh0YmgvQmhhdE5TTmJQWFpqMlhGRW50Z0piNTRxSktBZ1FWVWtlTUg0TDN0OW1WaFh4dDJzbFRmOWJhdFF0UGd3Vlo5TVFQZWtNNGovaCtKeTF2amFxR0pMMTg0fA&cppv=2

Protocol

Server

178.250.0.157 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

f1dcb9661e2211f23c7624128d11641239acd838ba0fd67d4f11f66810ae456e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://creativedestructionmedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:37 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1240624
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:37 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=Whv-0HxPSllzUEdpRTU1eEJhUmRTTmVLbm9BSU83Zk9XaW9oeTlpY1A3WG5ZL1JXMUVFQTA0bUYzMTlTc2MyVFVXaWdCNkRLc1JIRCtQUVJFQ0w2RmtabzNvN29DbitWQ3dvQVAxVGFHa0EvNTh6L0c1RjFZUmdCampDbHU2amNzY09aRjArNkhCeWpJSUtEcVlEQmxleUczTWFvYXI2d2hCUk40UjlEUjh0YmgvQmhhdE5TTmJQWFpqMlhGRW50Z0piNTRxSktBZ1FWVWtlTUg0TDN0OW1WaFh4dDJzbFRmOWJhdFF0UGd3Vlo5TVFQZWtNNGovaCtKeTF2amFxR0pMMTg0fA&cppv=2
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 579516
content-length: 0
expires: 0

POST
H/1.1 200 1285.json Show response
id5-sync.com/g/v2/ 216 B
638 B 121ms
38ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1285.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

b6c6d1298cfb32cc714a5487600381db0ff8018312e4c0fc84da11f4cdf0d188

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://creativedestructionmedia.com
date: Tue, 27 Dec 2022 15:39:37 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
324 B 189ms
59ms XHR
application/json 52.18.150.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.150.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-150-142.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:37 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: no-cache
x-server: 10.45.0.82
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
399 B 212ms
63ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 7f9cdff39a3a751177e3889f6cbfd0be78191693417b28e8649d9330e1f3b322

Request headers

Referer: https://creativedestructionmedia.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:37 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://creativedestructionmedia.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Thu, 26 Jan 2023 15:39:37 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 146ms
46ms Preflight
application/json 178.250.0.157

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 27 Dec 2022 15:39:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 538610
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 / Show response
s.0cf.io/ Frame 2C61 37 KB
14 KB 267ms
175ms Document
text/html 2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Requested by

Host: prebid.dblks.net
URL: https://prebid.dblks.net/ff/2659176.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://creativedestructionmedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: MISS
cf-ray: 7803266eff6f5c1a-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:38 GMT
expires: Tue, 27 Dec 2022 16:09:38 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Dfkt%2FOztnHCVHA%2FpRkvgpV8PIXwVtfzYJQtAIzwiVfka3plmRBlzRb%2F7K0OzHbDOn6p%2BfeZ4LpdnjK9sjDtyz2oDcBG57CtdpwpjXKiLbTxyThx8QEqSX37dn5%2FUy7Lf6chzGeTAg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H/1.1

200
OK

getuidj Show response
ib.adnxs.com/ Frame 2C61
Redirect Chain

https://ib.adnxs.com/getuid?https://ib.adnxs.com/getuidj
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fib.adnxs.com%2Fgetuidj
https://ib.adnxs.com/getuidj

29 B
982 B

52ms
52ms

Fetch
application/json

37.252.171.85

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/getuidj

Protocol

HTTP/1.1

Server

37.252.171.85 -, , ASN (),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

ae89bf232aa456a8cde335218d15446b5fd38cb046dd4fc50a093897f7ef6958

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
AN-X-Request-Uuid: 8c025b78-d564-43ba-a4c7-1e38b4bb5bf0
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://s.0cf.io
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 80.255.7.102; 80.255.7.102; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 29
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Date: Tue, 27 Dec 2022 15:39:39 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.102; 80.255.7.102; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4f3d235b-997c-47bf-9114-5b6b6e8a81fe
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://s.0cf.io
Location: https://ib.adnxs.com/getuidj
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

/ Show response
s.0cf.io/ Frame 1925
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D76%26uid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D76%26uid%3D%24UID
https://s.0cf.io/

37 KB
14 KB

55ms
55ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032671591990ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gvWZ75Gh%2FmJWiHcHtnkMKx%2FigG3y9qvdaDD0hiAnEvs95l15uTPKBEPBHeo%2BkQy89t2tR6epjDJVVjLVppJT78CBtXo728YWdvrUYHJuzzgLfC9Fmci%2BNU%2BuPLhXtU82e1gK0s45dg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=76&uid=1610795978671825776793
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 getuids Show response
prebid-server.rubiconproject.com/ Frame 2C61 2 B
247 B 236ms
39ms Fetch
application/json 3.124.221.254

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/getuids
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.221.254 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
content-encoding: gzip
content-type: application/json;charset=utf-8
access-control-allow-origin: https://s.0cf.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 28
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 2C61 63 B
385 B 59ms
58ms Fetch
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=prebid&fmt=json
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: ac2135909b9bbfd5d1288413601bb3d212a62bd413e066cf5dd5e219759b71d5

Request headers

Referer: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:38 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://s.0cf.io
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Thu, 26 Jan 2023 15:39:38 GMT

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame 0C5B 1 KB
824 B 161ms
69ms Document
text/html 2606:4700:10::6816:37ce

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?gdpr=0&consent=0&us_privacy=0&cb=https%3A//prebid.adnxs.com/pbs/v1/setuid%3Fbidder%3Dconnectad%26gdpr%3D%0%26gdpr_consent%3D0%26uid%3D86%26uid%3D
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 78032670ce20bbbb-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 27 Dec 2022 15:39:39 GMT
server: cloudflare

GET
H2 204 current
prebid-match.dotomi.com/match/bounce/ Frame E20C 0
0 206ms
78ms Document
text/plain 2a02:fa8:8806:12::1370

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-match.dotomi.com/match/bounce/current?version=1&networkId=72582&rurl=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D10%26uid%3D
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, private, max-age=0, no-store
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: 0
pragma: no-cache
server: nginx

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 53CC 5 KB
2 KB 205ms
57ms Document
text/html 52.48.187.67

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.187.67 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 37f07ff7638112e03890c8501927112fef00a79c57aac69b4347ac1db2a3a683

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 27 Dec 2022 15:39:39 GMT
etag: W/"0ac34fa62cef8f965b725de74abfbfc05"
server: nginx
timing-allow-origin: *

GET
H3

200

/ Show response
s.0cf.io/ Frame 2987
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=184932&cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D74%26uid%3D
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D74%26uid%3D&s=184932&C=1
https://s.0cf.io/

37 KB
14 KB

47ms
47ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032671c99790ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xxpI3jZvgefzJsN48hK8qjG8gCSq6hPVnv7uyFz%2BoiPmveT7ZoRy0hivonAp7PPRbqDaBj9Ulo46WvCf2qsKSYDjMzzZgbmDOjizMCSJRhY55pdppR26SNzyQElhwQKSt43EDsc7JQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 780326716a12901c-FRA
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: 0
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=74&uid=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NLQ2Vh7k8kXSEX%2FZG5CW92RNXg5ZqTWDxsV9Iesol1jiNygEN9LQ%2BLbK3qTmv5kOseYUe3JvxtBm63nFeGlytJInb4YOSrSQo6n%2BCyjUF9Koh1jHYv1LOIkzjstvJUqEL3J9Q%2Bip"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 prebid Show response
rtb.openx.net/sync/ Frame 809D 43 B
351 B 181ms
48ms Document
image/gif 35.186.253.211

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D19%26uid%3D%24%7BUID%7D
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 -, , ASN (),
Reverse DNS
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: null
access-control-expose-headers
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Tue, 27 Dec 2022 15:39:38 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
server: Cowboy
vary: Origin
via: 1.1 google
x-request-id: d2v54u942u2bdnoq95lq6vupujorqao5

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame B115 0
0 151ms
42ms Document
text/plain 216.52.2.30

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D25%26uid%3D%24UID
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Date: Tue, 27 Dec 2022 15:39:39 GMT
X-Sovrn-Pod: ad_ap6ams1

GET
H/1.1 200
OK us.gif Show response
sync.go.sonobi.com/ Frame 6CE5 49 B
533 B 489ms
119ms Document
image/gif 69.166.1.12

General

Check archive.org

Show headers Download Go to

Full URL

https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D26%26uid%3D%5BUID%5D

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.12 -, , ASN (),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, private
Content-Length: 49
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Server: sonobi-go
Tcn: Choice
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-24
X-Xss-Protection: 0

GET
H2

200

generic Show response
match.adsrvr.org/track/cmf/ Frame 82FB
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=0&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D22%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmphb?zcc=1&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D22%26uid%3D%5BRX_UUID%5D&cb=1672155579039
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=470582723

70 B
264 B

59ms
58ms

Document
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=470582723
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Tue, 27 Dec 2022 15:39:39 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
etag: RX4852e2806da442c2b6c3d7eeedf8ef98003
expires: 0
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=470582723
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
pragma: no-cache

GET
H3

200

/ Show response
s.0cf.io/ Frame A199
Redirect Chain

https://ups.analytics.yahoo.com/ups/58448/occ?uid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e77%26uid%3D
https://ups.analytics.yahoo.com/ups/58448/occ?uid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e77%26uid%3D&verify=true
https://s.0cf.io/

37 KB
14 KB

52ms
51ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032671692e90ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hhPJVk12Tie6hAZYmPK%2BVdhaTtvC4fSyzCiUQRWUN55ZIlX9LIQHMiT75lWRW1eDwcLJaJbyag19Fc2mGjPVlwfwkZSOjYJMtDnmHlhC4oA95dY3sniiUYeKX05RzmPSHvwtYnXjUg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

age: 0
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e77&uid=&id=77&uid=y-E7ZBzNdE2uHvqi89KOy7ZYvXKBER6vSvY08uAYI-~A
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.10.25
strict-transport-security: max-age=31536000

GET
H3

200

/ Show response
s.0cf.io/ Frame 6346
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=0&cb=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D81%26uid%3D
https://s.0cf.io/

37 KB
14 KB

50ms
50ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 7803267128d190ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qmJqOnqqMZBL7Xas4yZJ7IKAYyxH6qykl4iK3Zq8v5vssDapqe3dXKkt9k%2BRKP%2FmBzsuaKGbeDLhkN0iVGVMlEtP1b%2BkVUrkGcB%2BdYv7W9DOwYWT5ckEwf9e9kC3rKJB0HXB6OSMNw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

cache-control: max-age=0, private, must-revalidate
content-length: 0
date: Tue, 27 Dec 2022 15:39:38 GMT
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=81&uid=904ce5da-e233-4d44-af34-3d7ab6124fba&gdpr=0&gdpr_consent=0&us_privacy=
server: envoy
x-envoy-upstream-service-time: 1

GET
H3

200

/ Show response
s.0cf.io/ps/ Frame 7D7F
Redirect Chain

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fs.0cf.io%2Fps%2F%3Fps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D84%26uid%3D%24%7BUSER_TOKEN%7D
https://s.0cf.io/ps/?ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=84&uid=

2 B
504 B

178ms
178ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/ps/?ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=84&uid=

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

8d74beec1be996322ad76813bafb92d40839895d6dd7ee808b17ca201eac98be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: MISS
cf-ray: 7803267108ad90ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 04 Oct 2021 18:28:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=taDmrUh4RmpHg9sda25t6RcfOJybozh%2BWvkOgV%2Bn76c%2BOzK9cuhjFDtSlH5v4u6wh5VmSiIyErOwv6aOL5Auny4d4%2BdeC6ls5ITeuBlkg4hFJNL1JbufLw1LqrNBwv1plOzLrRIpDg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

cache-control: no-store
content-length: 0
location: https://s.0cf.io/ps/?ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=84&uid=
strict-transport-security: max-age=15552000

GET
H2 200 getsync Show response
ads.servenobid.com/ Frame 2C61 9 B
291 B 179ms
54ms Fetch
text/plain 52.48.223.30

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/getsync?tek=pbs&ver=1&gdpr=0&gdpr_consent=0&us_privacy=0&format=json
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.223.30 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72d427b7264997760074a94dcc1c9e54ae2c33b05276bfb3cfcd0f5d2d8bba3a

Request headers

Referer: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
amp-access-control-allow-source-origin: *
content-type: text/plain;charset=ISO-8859-1
access-control-allow-origin: https://s.0cf.io
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 9

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame A665 0
0 405ms
130ms Document
text/plain 67.202.105.23

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?gdpr_58=&gdpr_consent=&ts=&ri=70&ru=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D1%26uid%3D33XUSERID33X
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 -, , ASN (),
Reverse DNS
Software: 33XP011 /
Resource Hash

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
server: 33XP011
x-33x-status: 2000208

GET
H3

200

/ Show response
s.0cf.io/ Frame C1DF
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=162168&gdpr=0&gdpr_consent=0&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D162168%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fs.0cf.io%25...
https://image8.pubmatic.com/AdServer/ImgSync?p=162168&gdpr=0&gdpr_consent=0&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D162168%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fs.0cf.io%25...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QTc4ODZBRUQtMTUzMS00N0UxLThBNkQtOTFENzEyQzIzQzA1&gdpr=0&gdpr_consent=0
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=0
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=0
https://image4.pubmatic.com/AdServer/SPug?p=162168&pmc=1&pr=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26id%3D20%26uid%3DA7886AED-1531-47E1-8A6D-91D712C23C05
https://s.0cf.io/

37 KB
14 KB

50ms
50ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032674dd3290ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f1GGoTG%2B2ao9jLSgLfLgtAWtJQvPAs3HrYNuBOxphrcb%2BpgxGiIxPExXn5sXoduKEYpvQwY7iWzcVK42NZ34C4K4FyR9R9k69raf352qYxAdNjjLiQEglEUkarEKMKQ6JMRL45fqVw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 27 Dec 2022 15:39:39 GMT
location: https://s.0cf.io/#ps=true&id=20&uid=A7886AED-1531-47E1-8A6D-91D712C23C05
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H3

200

/ Show response
s.0cf.io/ Frame EDA4
Redirect Chain

https://bh.contextweb.com/rtset?pid=561205&ev=1&rurl=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D21%26uid%3D%25%25VGUID%25%25
https://s.0cf.io/

37 KB
14 KB

48ms
48ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 780326731b1090ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b79lBMjqdyHJmeN0VgxNc3x63gCIrPU%2FmCcpepMEQTGvw6h6qX7xXyEBnn%2B3qRwVWz3LzY2gvAn45DRNX9ZRw9%2B2yzSwmWI2cdrnpniY%2FVzber%2ByztzwCYBMRXDT6LM%2FMS05P7j3fg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
content-language: de-DE
cw-server: bh-deployment-7b977cc7b4-7jtmm
expires: -1
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=21&uid=fq8TzbBmA3za&ev=1&pid=561205
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000

GET
H2 204 v1
match.sharethrough.com/universal/ Frame 297A 0
0 138ms
39ms Document
text/plain 18.185.140.98

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/universal/v1?supply_id=Uj448boa
Requested by: Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.140.98 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT

GET
H3

200

/ Show response
s.0cf.io/ Frame 8CDA
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=0&us_privacy=0&redirectUri=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%...
https://s.0cf.io/

37 KB
14 KB

49ms
49ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032671c99590ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J7qO9iug%2BOVQTn3w7GC2HT5fQvtE62JNtWq55CVlVW7aw3qll53jvZFwQ%2F6WmvST95Kb5PG3i%2BxwU%2F5YMsY3NrO5TpCeEu5QfrcbzzIyfFBXNr8Fk6cPkbIEIj5zgvFaOH7J5RBnrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Tue, 27 Dec 2022 15:39:38 GMT
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=82&uid=133130337172360044

GET
H3

200

/ Show response
s.0cf.io/ps/ Frame 4483
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm&google_nid=datablocks_inc&google_hm=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e
https://cm.g.doubleclick.net/pixel?google_cm=&google_nid=datablocks_inc&google_hm=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&google_tc=
https://s.0cf.io/ps/?dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e

2 B
505 B

171ms
171ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/ps/?dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

8d74beec1be996322ad76813bafb92d40839895d6dd7ee808b17ca201eac98be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: MISS
cf-ray: 7803267219f290ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 04 Oct 2021 18:28:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DWJHeX7%2Bwb5FyWKTVkp2%2BBcy1xJV086VLVKelfvSlQgYf7b4oUyHqUtgx7Y4ZtWa0klr4KgXoVWm1EffKpPCW9sQGLCF9Z7f8fYWD%2BMGHjHVpm0Na1yTW5J4SyWKfRtRAukyWo128A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 336
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://s.0cf.io/ps/?dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e#ps=true&id=666&uid=CAESEGdkJIXKB_euWcPpnGb2aNc&cver=1&error=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H3

200

/ Show response
s.0cf.io/ Frame F412
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&gdpr=0&gdpr_consent=0&us_privacy=0&redir=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D61%26uid%3D%5BMM_UUI...
https://s.0cf.io/

37 KB
14 KB

47ms
47ms

Document
text/html

2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Host: s.0cf.io
URL: https://s.0cf.io/?gdpr=0&gdprConsent=&bidid=283594898-303961-8110-3&id=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&uid=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://s.0cf.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 780326735b6e90ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A8wrVVtpiHihdhv5vFPztH8deIm79nrbbPv9pvX0n1CjOLHXvGL8D7UbRGZPCEwl5iHFrboVZPSB0d%2BpbYSNCxwrZZpana%2B3o6KL%2F9hRmQvgperAo%2FH%2BRjuQjzVItfzpNqZd6obVmg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: Tue, 27 Dec 2022 15:39:38 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 277 3f0ad7a master cdg-pixel-x28 config:1.0.0
location: https://s.0cf.io/#ps=true&dbid=cff49d9d-5c52-44aa-a309-4d4cc50ce52e&id=61&uid=97a463ab-11bb-4d00-af91-fa7ddb583efb&gdpr=0&gdpr_consent=0

GET
H2 204 1
sync-eu.connectad.io/syncer/ Frame 1EF7 0
0 65ms
50ms Document
text/plain 2606:4700:10::6816:37ce

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/syncer/1?gdpr=0&consent=0&us_privacy=0&cb=https%3A//prebid.adnxs.com/pbs/v1/setuid%3Fbidder%3Dconnectad%26gdpr%3D%0%26gdpr_consent%3D0%26uid%3D86%26uid%3D
Requested by: Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?gdpr=0&consent=0&us_privacy=0&cb=https%3A//prebid.adnxs.com/pbs/v1/setuid%3Fbidder%3Dconnectad%26gdpr%3D%0%26gdpr_consent%3D0%26uid%3D86%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://cdn.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 780326715f54bbbb-FRA
date: Tue, 27 Dec 2022 15:39:39 GMT
server: cloudflare

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2706312133842823575

35 B
250 B

302ms
93ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2706312133842823575
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Tue, 27 Dec 2022 15:39:39 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.102; 80.255.7.102; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4596bb20-0579-4766-8a9b-8efc77c189ec
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=2706312133842823575
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy=
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=ccfe6910-32a4-4785-be4e-49a7bc50c305
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=gumgum2&expires=10&bsw_param=ccfe6910-32a4-4785-be4e-49a7bc50c305
https://usersync.gumgum.com/usersync?b=bsw&i=ccfe6910-32a4-4785-be4e-49a7bc50c305

35 B
250 B

126ms
56ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=ccfe6910-32a4-4785-be4e-49a7bc50c305
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: //usersync.gumgum.com/usersync?b=bsw&i=ccfe6910-32a4-4785-be4e-49a7bc50c305
date: Tue, 27 Dec 2022 15:39:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=0
https://usersync.gumgum.com/usersync?b=sta&i=0-2106e0f6-d961-47b9-7961-337a764edcd6$ip$80.255.7.102

35 B
250 B

57ms
57ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-2106e0f6-d961-47b9-7961-337a764edcd6$ip$80.255.7.102
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-2106e0f6-d961-47b9-7961-337a764edcd6$ip$80.255.7.102
Date: Tue, 27 Dec 2022 15:39:39 GMT
Connection: keep-alive
Content-Length: 126
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&gdpr=0&gdpr_consent=0&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://usersync.gumgum.com/usersync?b=zem&i=&gdpr=0&gdpr_consent=0

35 B
250 B

56ms
56ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=&gdpr=0&gdpr_consent=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=zem&i=&gdpr=0&gdpr_consent=0
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 102
Content-Type: text/html; charset=utf-8

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 53CC
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=0&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5297189373

70 B
264 B

60ms
58ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5297189373
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: H2
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
etag: RX4852e2806da442c2b6c3d7eeedf8ef98003
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5297189373
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=3xJzAV2mcjqh&ev=1&pid=558355

35 B
250 B

237ms
94ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=3xJzAV2mcjqh&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
location: https://usersync.gumgum.com/usersync?b=pln&i=3xJzAV2mcjqh&ev=1&pid=558355
content-language: de-DE
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7b977cc7b4-rv676
expires: -1

GET

c.gif
c.bing.com/ Frame 53CC
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=0&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7Bob...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28VEP5SRICO_3iMQaliVsQ579nsZ4e0Oa1bL2xYraD_8bDhWT_cvk6gO1RDkSODdgs%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&obuid=ENC(VEP5SRICO_3iMQaliVsQ579nsZ4e0Oa1bL2xYraD_8bDhWT_cvk6gO1RDkSODdgs)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=0&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=0&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=c611ef8a-f88e-48df-8ed0-6b76163a5d3f&gdpr=0&gdpr_consent=0

35 B
250 B

243ms
92ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=c611ef8a-f88e-48df-8ed0-6b76163a5d3f&gdpr=0&gdpr_consent=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 27 Dec 2022 15:39:39 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=c611ef8a-f88e-48df-8ed0-6b76163a5d3f&gdpr=0&gdpr_consent=0
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 53CC 43 B
426 B 195ms
57ms Image
image/gif 2a05:d018:d29:3602:17a1:3e8:dac1:363e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=0

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:17a1:3e8:dac1:363e -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=0&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersyn...
https://usersync.gumgum.com/usersync?b=vnt&i=5a0a9403-5480-4719-ab8d-6a942d30e32b

35 B
250 B

58ms
58ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=5a0a9403-5480-4719-ab8d-6a942d30e32b
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=5a0a9403-5480-4719-ab8d-6a942d30e32b
Date: Tue, 27 Dec 2022 15:39:39 GMT
Connection: keep-alive
X-CI-RTID: 2416ed14-0ccf-4de4-b458-b68afcf08523
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 204 services
sync.technoratimedia.com/ Frame 53CC 0
294 B 435ms
160ms Image
text/plain 150.136.26.45

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 150.136.26.45 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 290821634
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 53CC 0
44 B 489ms
123ms Image
text/plain 8.18.47.7

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 -, , ASN (),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:38 GMT
content-length: 0
server: c

GET

server_match
ad.360yield.com/ul_cb/ Frame 53CC
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D

0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 53CC
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=0
https://usersync.gumgum.com/usersync?b=sad&i=133130337172360044

35 B
250 B

54ms
54ms

Image
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=133130337172360044
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 27 Dec 2022 15:39:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=133130337172360044
date: Tue, 27 Dec 2022 15:39:38 GMT
content-length: 0

GET oRTB
sync.inmobi.com/ Frame D802 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 101E 16 KB
6 KB 49ms
47ms Document
text/html 23.203.124.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.203.124.192 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-124-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=158591
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Thu, 29 Dec 2022 11:42:50 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame 6BB4 70 B
264 B 60ms
59ms Document
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Tue, 27 Dec 2022 15:39:39 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame D549
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=0&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=bacf63ab-11bb-4300-ae0b-cfc904cec643&gdpr=0&gdpr_consent=0

35 B
250 B

93ms
57ms

Document
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=bacf63ab-11bb-4300-ae0b-cfc904cec643&gdpr=0&gdpr_consent=0
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: Tue, 27 Dec 2022 15:39:38 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 277 3f0ad7a master cdg-pixel-x30 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=bacf63ab-11bb-4300-ae0b-cfc904cec643&gdpr=0&gdpr_consent=0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 9D1F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=0
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo
https://usersync.gumgum.com/usersync?b=atm&i=Y6sRuwAHKo4KpwAo&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo

35 B
250 B

133ms
101ms

Document
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=Y6sRuwAHKo4KpwAo&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=Y6sRuwAHKo4KpwAo&gdpr=0&gdpr_consent=0&_test=Y6sRuwAHKo4KpwAo
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hhn-etou8220037-HHN
x-timer: S1672155579.399023,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame B4C4 170 B
188 B 82ms
63ms Document
image/png 142.250.186.34

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV8wYWI4OWM5Mi1lNzAzLTRkNDItOTk3NC01ZjA0Y2RiMzRjMGM=&gdpr=0&gdpr_consent=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame D41E
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=0
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY2...
https://cs.emxdgt.com/umcheck?apnxid=2706312133842823575&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY29tL3VzZXJzeW5jP2I9ZW14Jmk9JEVNW...
https://usersync.gumgum.com/usersync?b=emx&i=2706312133842823575brt50851672155579284796f1

35 B
250 B

149ms
104ms

Document
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&i=2706312133842823575brt50851672155579284796f1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Tue, 27 Dec 2022 15:39:38 GMT
location: https://usersync.gumgum.com/usersync?b=emx&i=2706312133842823575brt50851672155579284796f1

GET idsync
tg.socdm.com/aux/ Frame E732 0
0

GET gumgum
cs.admanmedia.com/sync/ Frame 704F 0
0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame FF03
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115

35 B
250 B

123ms
59ms

Document
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=iex&i=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 780326728baf2be9-FRA
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: 0
location: https://usersync.gumgum.com/usersync?b=iex&i=Y6sRu8i5w.nzV4CsWZ.aHwAA%261115
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4YBu5fNyrYNOlSDZGH6Q9xYws6VVlJXpd841jvuNlL3Bmk83LrJ2ObE5ZiijJUpn0R0mczkK52RRQjT6eV4ePwjH6Hq45p5cjpiOlQ%2Byy0wypcb3hRWTGsujwjGi1k%2BnX8miBHi5VfNxhA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 97A1
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=iZmCIAvYAtdwjxXZ7wXh&pi=gumgum&tc=1

35 B
250 B

125ms
59ms

Document
image/gif

34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=iZmCIAvYAtdwjxXZ7wXh&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT Tue, 27 Dec 2022 15:39:39 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=iZmCIAvYAtdwjxXZ7wXh&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 984B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

187ms
45ms

Document
text/html

23.2.211.147

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/prbds2s?iframe=1&gdpr=0&gdpr_consent=0&r=https%3A%2F%2Fs.0cf.io%2F%23ps%3Dtrue%26dbid%3Dcff49d9d-5c52-44aa-a309-4d4cc50ce52e%26id%3D15%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.211.147 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 27 Dec 2022 15:39:39 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H3 200 / Show response
s.0cf.io/ Frame 8618 37 KB
14 KB 50ms
49ms Document
text/html 2606:4700:e4::ac40:a903

General

Check archive.org

Show headers Download Go to

Full URL

https://s.0cf.io/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:e4::ac40:a903 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4270
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=1800
cf-cache-status: HIT
cf-ray: 78032671b98990ba-FRA
content-encoding: br
content-type: text/html
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Tue, 27 Dec 2022 16:09:39 GMT
last-modified: Mon, 15 Aug 2022 14:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s9THLbt%2FZ6wblBiIw2e4IPHoMbrgoS3fiqLic%2FQ0LvLmPpu0brRXxFKuHhs6N6ywc6lp%2FN%2BpNcXeVPdCjfm%2F1GTLYH0pn0CnARcAtDzaOlN0yBQTq3cJZh0m%2BsXymEjzmIVOLa3pVA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 101E 2 KB
3 KB 178ms
40ms Script
text/html 198.47.127.19

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=83970271&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 502cfa5439b73e11066bf263e5a8feb38f379ddd4a5d93519d99046f818317a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 27 Dec 2022 15:39:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F3EA
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:56a563ab-11bb-4500-8f28-67cccb48fd5a&gdpr=0&gdpr_consent=

42 B
406 B

49ms
46ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:56a563ab-11bb-4500-8f28-67cccb48fd5a&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:38 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: Tue, 27 Dec 2022 15:39:38 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 277 3f0ad7a master cdg-pixel-x30 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:56a563ab-11bb-4500-8f28-67cccb48fd5a&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame AFA8
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7218457549909024635

42 B
275 B

46ms
46ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7218457549909024635
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7218457549909024635
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 6582 43 B
363 B 187ms
76ms Document
image/gif 178.250.2.151

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.151 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Tue, 27 Dec 2022 15:39:38 GMT
expires: Tue, 27 Dec 2022 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 363389
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET

dcm
aax-eu.amazon-adsystem.com/s/ Frame 7F87
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent=&dcc=t

0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame FBC7
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2706312133842823575&gdpr=0&gdpr_consent=

42 B
316 B

59ms
58ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2706312133842823575&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

AN-X-Request-Uuid: ec5bb3d4-0bf6-4cb7-8d31-b32aea28d34f
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=2706312133842823575&gdpr=0&gdpr_consent=
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 80.255.7.102; 80.255.7.102; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame C9B3
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=0DDzKNcy8CjLO_Z_gjq_KIM1p37LMqt5hDL8LytP

42 B
341 B

46ms
46ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=0DDzKNcy8CjLO_Z_gjq_KIM1p37LMqt5hDL8LytP
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Tue, 27 Dec 2022 15:39:39 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=0DDzKNcy8CjLO_Z_gjq_KIM1p37LMqt5hDL8LytP
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H/1.1 200 usersync Show response
usersync.gumgum.com/ Frame BB45 35 B
250 B 93ms
68ms Document
image/gif 34.247.233.198

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=A7886AED-1531-47E1-8A6D-91D712C23C05
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.247.233.198 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 27 Dec 2022 15:39:39 GMT
Expires: 0
Pragma: no-cache

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 101E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=p4hq7RUxR-GKbZHXEsI8BQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

51ms
47ms

Image
text/html

23.203.124.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Server: 23.203.124.192 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-124-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=158591
accept-ranges: bytes
content-length: 5554
expires: Thu, 29 Dec 2022 11:42:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mw
mwzeom.zeotap.com/ Frame 101E 95 B
382 B 195ms
89ms Image
image/png 2606:4700:10::6816:1857

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=A7886AED-1531-47E1-8A6D-91D712C23C05
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://ads.pubmatic.com
access-control-allow-credentials: true
cf-ray: 780326742fa62bd9-FRA
access-control-allow-headers: *
content-length: 95

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame 101E 49 B
266 B 224ms
54ms Image
image/gif 34.246.104.18

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=A7886AED-1531-47E1-8A6D-91D712C23C05&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.104.18 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.26.173
content-length: 49
expires: 0

GET

ids
idsync.frontend.weborama.fr/ Frame 101E
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=3146363876
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=A7886AED-1531-47E1-8A6D-91D712C23C05

0
0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 101E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO0InM6rPeoNSEzUlqBWHl8&google_cver=1

42 B
300 B

47ms
44ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO0InM6rPeoNSEzUlqBWHl8&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:39 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO0InM6rPeoNSEzUlqBWHl8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 101E 43 B
612 B 188ms
80ms Image
image/gif 35.204.74.118

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 -, , ASN (),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 15:39:39 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Mon, 26 Dec 2022 15:39:39 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 101E 70 B
264 B 61ms
60ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 101E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=3701215670987294756

42 B
219 B

47ms
47ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=3701215670987294756
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=0
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 27 Dec 2022 15:39:39 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 27 Dec 2022 15:39:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=3701215670987294756
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 984B 34 KB
10 KB 67ms
66ms Script
text/html 23.2.211.147

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.211.147 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ec25b880a7019e9e0f004c2bf84f01125b2169c7b21b53745fa7d0248d083336

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Tue, 27 Dec 2022 15:39:39 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Dec 2022 23:16:30 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=27338
Connection: keep-alive
Content-Length: 10067
Expires: Tue, 27 Dec 2022 23:15:17 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 984B 284 B
536 B 206ms
39ms Image
image/jpg 69.173.144.139

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET sync.php
pixel.rubiconproject.com/exchange/ Frame 984B 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: trends.revcontent.com
URL: https://trends.revcontent.com/sync

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity/envelope?pid=13781

Domain: c.bing.com
URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

Domain: ad.360yield.com
URL: https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D

Domain: sync.inmobi.com
URL: https://sync.inmobi.com/oRTB?gdpr_consent=0&gdpr=0&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dinm%26i%3D%7BID5UID%7D

Domain: tg.socdm.com
URL: https://tg.socdm.com/aux/idsync?proto=gumgum

Domain: cs.admanmedia.com
URL: https://cs.admanmedia.com/sync/gumgum?puid=e_0ab89c92-e703-4d42-9974-5f04cdb34c0c&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=0&ccpa=

Domain: aax-eu.amazon-adsystem.com
URL: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=A7886AED-1531-47E1-8A6D-91D712C23C05&redir=true&gdpr=0&gdpr_consent=&dcc=t

Domain: idsync.frontend.weborama.fr
URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=A7886AED-1531-47E1-8A6D-91D712C23C05

Domain: pixel.rubiconproject.com
URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum

Verdicts & Comments Add Verdict or Comment

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bit.ly/	1970-01-20 12:48:27	Name: _bit Value: mbrfDu-b6ec677803266dbe6d-00i
creativedestructionmedia.com/	1970-01-20 08:29:17	Name: ppwp_wp_session Value: 2f4a0201926db3d6300e007c9fa3a509%7C%7C1672157371%7C%7C1672157011
.creativedestructionmedia.com/	1970-01-20 17:14:51	Name: _jsuid Value: 1697427276
.creativedestructionmedia.com/	1970-01-20 09:55:39	Name: cb804f94b3a9f5e210e4c75576e5451a_id Value: 6432931
.creativedestructionmedia.com/	1970-01-20 09:55:39	Name: cb804f94b3a9f5e210e4c75576e5451a_hash Value: 9046d35171dff43aa62a26f7b0d0d702
.creativedestructionmedia.com/	1970-01-20 09:55:39	Name: pipay_ext Value: 1
m.stripe.com/	1970-01-20 18:05:15	Name: m Value: fb577ded-eb6e-4352-a7c9-384e2931fb2475b092
.creativedestructionmedia.com/	1970-01-20 17:14:51	Name: __stripe_mid Value: 76c62bfd-5c8c-4def-9b31-6c68643bf1d26627ad
.creativedestructionmedia.com/	1970-01-20 08:29:17	Name: __stripe_sid Value: 5b9fa1fc-0c17-440d-83fc-3e4c6d18a35cfa1012
creativedestructionmedia.com/	1970-01-20 09:12:27	Name: _pbjs_userid_consent_data Value: 3524755945110770
.creativedestructionmedia.com/	1970-01-20 17:14:51	Name: _sharedid Value: 5d5e00a3-c53f-4fa2-af5e-f8b466df91de
.creativedestructionmedia.com/	1970-01-20 12:48:27	Name: _pubcid Value: 0d583db4-e151-49dc-8fea-ad52eedc16d4
creativedestructionmedia.com/	1970-01-20 08:29:19	Name: _lr_retry_request Value: true
creativedestructionmedia.com/	1970-01-20 09:12:27	Name: _lr_env_src_ats Value: false
creativedestructionmedia.com/	1970-01-20 09:55:39	Name: pbjs-unifiedid Value: %7B%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222022-12-27T15%3A39%3A37%22%7D

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
javascript	error	URL: https://creativedestructionmedia.com/investigations/2022/12/22/suspicious-elections-in-brazil-forensic-analysis-demonstrates-even-more-evidence-of-falsehood-in-brazilian-election-data-as-if-it-were-needed/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=13781' from origin 'https://creativedestructionmedia.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=13781 Message: Failed to load resource: net::ERR_FAILED
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').
network	error	URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=A7886AED-1531-47E1-8A6D-91D712C23C05&gdpr=0&gdpr_consent= Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://s.0cf.io/(Line 1) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://s.0cf.io') does not match the recipient window's origin ('https://creativedestructionmedia.com').

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-eu.amazon-adsystem.com
ad.360yield.com
ads.pubmatic.com
ads.servenobid.com
ap.lijit.com
api.rlcdn.com
assets.revcontent.com
b1sync.zemanta.com
bh.contextweb.com
bidswitch-eu.splicky.com
bit.ly
c.bing.com
c1.adform.net
cdn.connectad.io
cdn.onesignal.com
cdn.revcontent.com
cdnjs.cloudflare.com
choiceclips.whatfinger.com
classic.avantlink.com
cm.g.doubleclick.net
cms.quantserve.com
creativecdn.com
creativedestructionmedia.com
cs.admanmedia.com
cs.emxdgt.com
d5p.de17a.com
dis.criteo.com
eb2.3lift.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
graph.instagram.com
gum.criteo.com
ib.adnxs.com
id.crwdcntrl.net
id5-sync.com
idsync.frontend.weborama.fr
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.revcontent.com
img.onesignal.com
img.revcontent.com
in.getclicky.com
js.stripe.com
lexicon.33across.com
m.stripe.com
m.stripe.network
match.adsrvr.org
match.deepintent.com
match.sharethrough.com
mug.criteo.com
mwzeom.zeotap.com
my.creativedestructionmedia.com
onesignal.com
onetag-sys.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
prebid-match.dotomi.com
prebid-server.rubiconproject.com
prebid.a-mo.net
prebid.adnxs.com
prebid.dblks.net
q.stripe.com
rtb.gumgum.com
rtb.openx.net
s.0cf.io
s.dblks.net
s.w.org
scontent.cdninstagram.com
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
ssbsync-global.smartadserver.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
static.getclicky.com
sync-eu.connectad.io
sync-tm.everesttech.net
sync.1rx.io
sync.crwdcntrl.net
sync.go.sonobi.com
sync.inmobi.com
sync.ipredictive.com
sync.mathtag.com
sync.srv.stackadapt.com
sync.technoratimedia.com
tg.socdm.com
token.rubiconproject.com
trends.revcontent.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
usersync.gumgum.com
www.instagram.com
x.bidswitch.net
yeet.revcontent.com
aax-eu.amazon-adsystem.com
ad.360yield.com
api.rlcdn.com
c.bing.com
cs.admanmedia.com
idsync.frontend.weborama.fr
pixel.rubiconproject.com
sync.inmobi.com
tg.socdm.com
trends.revcontent.com
104.18.33.19
13.248.245.213
141.95.98.64
142.250.186.34
147.75.85.234
15.197.193.217
150.136.26.45
151.101.64.176
151.101.66.49
151.139.128.10
168.119.127.61
178.250.0.157
178.250.2.151
18.156.0.31
18.156.32.70
18.185.140.98
185.184.8.90
185.29.134.248
185.64.190.79
185.64.190.80
185.86.139.104
185.89.208.11
192.0.77.48
192.124.249.69
198.145.13.12
198.148.27.139
198.47.127.19
198.47.127.20
199.212.255.151
199.212.255.211
213.155.156.168
213.19.147.44
216.52.2.30
23.2.211.147
23.203.124.192
23.64.52.128
2600:1901:0:8344::
2606:4700:10::6816:1857
2606:4700:10::6816:37ce
2606:4700:3030::ac43:bfc6
2606:4700::6810:a010
2606:4700::6811:190e
2606:4700::6812:e134
2606:4700:e4::ac40:a903
2620:116:800d:21:e365:4988:e8a7:3270
2a00:1450:4001:811::2002
2a00:1450:4001:82f::200a
2a00:1450:400d:806::2003
2a02:2638::1c
2a02:fa8:8806:12::1370
2a03:2880:f21c:80c4:face:b00c:0:43fe
2a03:2880:f21c:80e5:face:b00c:0:4420
2a03:2880:f22d:c4:face:b00c:0:43fe
2a05:d018:d29:3602:17a1:3e8:dac1:363e
3.124.221.254
3.217.212.127
3.74.25.218
34.246.104.18
34.247.233.198
35.160.214.55
35.186.253.211
35.204.74.118
35.244.159.8
37.157.4.25
37.252.171.21
37.252.171.85
44.195.94.142
51.75.86.98
52.18.150.142
52.48.187.67
52.48.223.30
54.187.119.242
54.210.175.101
67.199.248.10
67.202.105.23
69.166.1.12
69.173.144.139
70.42.32.63
8.18.47.7
99.81.25.188
99.86.159.40
00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02a9cfb474fe030a6d6c349d41d6f2cb66995540969c5cfc18ac0df652fe401a
044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908
048057ad539a913ae9bfe366a6d270cec09c3ba03e771386dc8231c3442471f3
04b3d865ce727c0a876103fe37cf2c0040772f409352abe0c6f80250c197419b
063a952901506e6cbcc2abdd1995ea387e4ae9138993f5517834a75faee165d0
07759364dcd1575959453850bf12d822b800ab6a3b5c5ec00583f9ed804b0190
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60
0a4bc5b9e39156f467df7ab86787cb30f72d4a001da60d8eaa6f3c01f926f019
0a886b68ae530d4cc0fce59dcffb19554d695b868aa09014493b8fd1fb7425dc
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cb22db86fd281150ddd6bbf814d246682cb2f190d6f611fc708a1a9bcd6342c
0ea4399322b476f7be24324722c9e3ed7ebfa5e97955bfd4d11a1792be303943
13a0bd0a77080ee8f4f5eafe583e470871b7654bd7e38b2838e9b03f226c3805
140b3d4cbb8f59ea9f00ff0e3f94fe8202621d4ea2aa15372aaaf038d7d06db8
14358cfcabb3e5ce7ce1afe2932cf94a00a3697d6a9aeebe88be6eb68eb37d99
15594c9df39e77821918e374f726a7ab387d4a734c6b9cedfd927cbe9a32e89d
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
19395a31eba590812aa5b60221b9ae0f2afff2a89bffcd05efdb5e0001a4bf8d
1a3a632adb68e48e2ee55ac140c3ca5f24bbbf886906c0ef9fdbf5c07cf1bb48
1a6ec332f581bd6eb6fccca35ecdcad88f079961138a1e1b05b7d7e5924f3090
1e288c4dc57f72a69a497baef524f41c57e1c6a414b09a5bde22cd5b2f1b7cdf
223fc8122a307637f83efd6b57fb96e0daf8795aaa98e431e83064efa65b4da3
23beda30424ac7c49957ce15299d0199803995498851441548cf89108a12871b
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
29442b94e9fb88ea19926e07a72876dffccfaeb76782f69a2037576e3b415c26
2955a48ba0f06efe1174d25c3ded83160a53fad345cec5c7a5bfacdcfecbe359
29577c7c68f7a6fcf2359fe3134ac6f7f93c9c28b9d1adde6ba9d6c79a1c7ace
2a04fa46b4ebc4bb2c93126695f45b0acf711870e1f169bb95247592c28c24a8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bcfc55ef9a3bc1b3ee5d65d431998352afd3984c9f3301d7ee7667350fdd0e0
2ca69feef28c20ecd1ceecd849a2d43b1579310195a5d9bd469e2266b84f868f
2d3f90cd3335ea94073b894d19ba1041bcd3c7202cf98e741e7e93d428c5dccf
2d50dab5f88fc3226842f2389c6ba42f0e37b05e772eed09c1a0e1435a6dfdb0
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
31fe1bafd74b7bc8bb88aca7960401d95b1a6de990b9cbadc562c173b8c560e7
348526eb2bc1407316f8c681d30513df971b67b83fb57cdcd32c4e461ea56d49
3539e71564ed1010478020e559b88b87b3d72245ecccdad41de7b9d25d1ee788
35c92598a5f32c018dc630f57b183b0284c211ce9c222e5b36840a62115262f1
3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165
36b7d8525458210a8609ab58084128d933c83c45d08ed703b76f4a7c6355655b
37916b0c48fadfceebfbfb1777c42d5454209ccad3cf78db4a5565b32b53453e
37f07ff7638112e03890c8501927112fef00a79c57aac69b4347ac1db2a3a683
3840e516d88d341ed80ffb6533bb634866fd084423144b6941c6a0ed8e75fd1f
3a3be08a78b019b0ee92257ea3233a08c453ba41cad584d8c07df641c7fe772b
3ac7f47be06ed56cebf7d19f23386fa58144a3fec5dfb68a82edcecc20df444a
3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdc364eeb75f7f4a1a581857d0c5f2719e89939d9dd63bfe154f798edb81ab8
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
3fe8c79d67b21039a5d059ef40761950fb76e1d17933d61509f7eb3c68f5aeeb
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44267e9c2bfeccbe597ba228a32a4b23d9dba49016037bda5e9b6368f1f24961
481734c0d4cc6e4a4c5d21ba877fb47686041edf31a3c5764a5ca1818cedcfe9
487ef2c201c33553c12eb0d7b9360be8e16ee7770aa7b9b42368e4a442df53fc
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4a1c659bed192059b4eaefde30f39c40be49f5c466d8c9f1c95c78d3c13f3e22
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
502cfa5439b73e11066bf263e5a8feb38f379ddd4a5d93519d99046f818317a0
521cc807c765916486d3c1258f5552a182cc1b5f572ba9a83c818fddccee9675
548005b1d32066c8d7ab7b2f74d0d066d2607dc63bb3b6604ac7bc6f0eb38207
54c2687de64bd6df6f87c864412becc0ba8c43282e84fd5ef7949c347498b2c1
54e026f7f2e18074cbce4e26549c4f30daa4168d226d6f4d048a01638a89ca94
5527ea193cb91de1cea4f3e273eb53b029afc536f1bc79c7ce38e95e658e006e
57f35daeaf18c5fd0dfd54aa1e62d457f113d317b4df9cde5e2bd96cd271024a
58cef6c7011c8e3051862bbd48a0cb18418d6f40812deaeb03246fb5e1c245f2
5a515442e06d68ac60972b0e0f99195e0d27885218b3668004ef5c60e95e637c
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5d59372b6612612e1f165c140beb8e541b9becfa771862e2d61376252a2ba91f
5d9684cf63a19c44cf689180f7f37f61570a03d3a8a03ddaeb4e86fdc21155d0
5df946a5d4487aa5c327efc12c21a1b288041fe5276f03c03fa72e8aa513b015
5e1bd585900a6c5f23119bd9411c4e4030e3d1d3fa9e992a2d5186c1fb4ff689
60ef0341dc54e4cebc339e7f09e0f54ab87f85aba0d839aecf21c518955bbd3e
62f17afd48cf4e9be231b5ae10e836a6692c0679c2db163d73a9409f20d1dc1a
65e44a7952d26fcbb6efc7f9613cba40be50d352183045a4b9c9ea45fe7f8dea
6a9ab47bf0804d5975612c06e6bc5e7520879529c3ad311c4ce35668a0da3363
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38
6e0a031ae4aa5bdbf71ab65b04a7ad39091da8a7bff77fcedc1ebf56f29e2146
71d67862610b80dc5c9a9ceb03f4bf2e2e6305b17e490a32fec5139c40b00ba1
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
72d427b7264997760074a94dcc1c9e54ae2c33b05276bfb3cfcd0f5d2d8bba3a
784672eeb9a9c4a2656d5f0c838230d8808259520a21b74aa835050c93529e52
7f60f220836a7efb68485941d75c01ab1b0af071a2d0a5b13563c492fa0f4dc0
7f9cdff39a3a751177e3889f6cbfd0be78191693417b28e8649d9330e1f3b322
835e347cd1bf6ccfdbcf9fd51249ddc375bee11dcc3d1e175d24de2479cb9867
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
8507d163d2a5c3e4ae298f241d74883e6481b720e78543c08291102ec738b433
85f51306e8210bda2fee4a6f9ac5ceab89a7ae7ec1d9e00eaaf45515ce8be680
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8b4b43fd2629a9ae29c5220a852bbc8ff169c571cdf77798633efec65c934df7
8b8fc77efe2a8543d1bdb8e50931d3a7e11e84743e84acf9b628bec0fb588051
8c2230e1348d437f591bf23a319992999e4869ab9aef142861ae206b05ec1be4
8d55b6e9bdedfe8a90b42ae4d58ce585efa1fd1a69c734d6ed93698dd7ae20cf
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d74beec1be996322ad76813bafb92d40839895d6dd7ee808b17ca201eac98be
8e73a30d35c83ea6a597c3343324d2b7df097ad26e67b62efb5266ee12d317b5
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
92d6cc26916cd66aa6baa7829955829200236292f68561c1c0fc44cbf970b28d
9327647771c09df82095dba3591c77cca41a9cedca948ae01e7fb70c690dcbd5
94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5
962604c2cecfdd27ddfff445e7ffa338ecf8ed66da651b023c8aa688c0368766
96344c48276b6477946734dfa6f60c187fa33d371c0f4bc2156edc0e2868617c
9ae1b9f867c5a14924d3d6b09e57f7451a00917838dd127af0782a07551e3d58
9b7c9bb91016a0d17171d9a9307591530d2211c64f33104a1b87299a6b386f95
9ccad993216276fc9c27678222dd756704bd330065d5b68ee2e2a9a3eadf31f3
a0a2d0a480c0a1d11deb8abc7199c9a225294b11686a7d07816b187f66ecdb69
a267fc94858598e6633bb6d17cc72d1410ced16aa93638ff30e63cde05045e6e
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
a74ec5e2fe1a2f859edf8c7de03b43379030f58f17b8e57371a347620f5c9b31
a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596
aa612e58f9239911730a9653ae895ba3750157de71413b902512590bbbbcf58a
ac2135909b9bbfd5d1288413601bb3d212a62bd413e066cf5dd5e219759b71d5
ac28c5d29cc4ad0e9136c4f26bcc6c58f33b6852a874297ecd1367c1ba7d4eca
acf3f18d32ec0e6d987ef5adca6826834b664ee393a1ba2130f68797dca3acb9
acff1820ca73688f28b672f614e286c3ad77d187ce09919f8bbce811d4da1d1f
ae89bf232aa456a8cde335218d15446b5fd38cb046dd4fc50a093897f7ef6958
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1ac2a15d8cde0a9d51c87a83edf6c77e1260aa1d6b05022aeca1b900688a51c
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
b6c6d1298cfb32cc714a5487600381db0ff8018312e4c0fc84da11f4cdf0d188
b8d6468c892237d8824bd50466e7b187ea465f0d606412546423543e44d57c1c
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be201fb63f76d14aafe69b386631b37dcb4b3e3448f48a7486f27f8ee191f3db
c01a7aecfc31ccf424ee0b7a5293514789aad354d4159849b70ac2bd8be3d46a
c05a202bfec3c0e8fdba6936f9cf8ac41bcafd546ce89f29d16d6e347963fd6b
c807d0aea213a02abccdbddb53e6c465caa8cd8c1d8a4d6d24d94d681847a39c
c93b5f9c2d83611b9a9ba0333b0b499b385cdce2aee9edaac6daf8a134cf5555
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca6507f8b18edebcff32e0e69a3012b3e20ca7bb5f0ed4d5ff73b147654c7c86
ccd3bbf4e4e6d85aa636703e6b470e8837afac62d84cd78a2989f3c7c05d6951
cd9216308f7433d319f912cfc029861f0176f0d0af13c57338d291f757fb01de
ce561d824696efab70ddcd9dcbc3fe4e8e688851e6bea4e121cd9837323ef3eb
ceba4a27d1d5b002e5f9cc114910456581da48b66753f5c133b6280057c11811
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d4eaec858474f17cfe2930fc1de5994621679c350b330a66fb7f420aadaf81c1
d4ede232c81b584c3365b4a5fb756b6d7a762fbeb710e7cb12986c7c311364c2
d5f4b357ed7ae2404c777593555eb31ce085752d81e1462b916ae3fd331954c5
d6da22ca2b7058c87413a1927d90c13548535cfcb0959175fc0b32ac7417768b
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dc19613738e819a6a177f90db9b1fe75e7343cbfdaffb037c217d6f72151ab9f
de9954490715ce618665188122b2c8a18e92e417180c514429e7129ae967ff99
df07904cef6b39bb3662ce3980354f76a18829f78828aed882532bfcac2b93d4
e0b4f1f743985070019e0398c164d4f3cbf5b51db6bedc52873bbe9504ceb2bb
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb7a0b6dde6937dd421db9d96223766b25bbbee0076e64556f7bdd013faca65a
ec25b880a7019e9e0f004c2bf84f01125b2169c7b21b53745fa7d0248d083336
ecaf7c6120c108f09f760713589c1e26eee65c67a5e220a0eb2f25632a449d1e
ecf917978118862ae1fc715ef2f5d7cf541d22cf515bc480c07324037b8bba01
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef65d4be75ed748d868a0f1bce0527f6d7d17ef4ec3fd68d4c253f3fae85a1ad
f1b3231dbda0ba29dd7ec8c261181d2eda15c31c0aec2e7ee376f7d229371eed
f1dcb9661e2211f23c7624128d11641239acd838ba0fd67d4f11f66810ae456e
f1e53b769e7bf6486d9d6feb2c1318047bae3643291710c27648d7c1c6f00198
f407a07bbc292cdf43c203945bfa640c114c28a0ff126611a134180e17617e5c
f4241710e57486ad91102e31823e855469608e1aea362f1f0e059609c9eb9a56
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083
f455a880c75fdef0c83a5623ef4fb1d941664b647fe51624082a0d3e30450c50
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5e031863afc70ff89bde055fe5405cc8758808cfa3629d997adbb2acf6bd5cf
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7163559d8b2983cff10f0b2e0317bf000fd5ed1dd17984673ff43e32ba49d22
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f7c370aec03546de5bb7531b8885578dfc3c53aab15401907c55dac988808dd2
fb2dfaf032a461215f7fe0ee873b2e6b9b617d11e5fdfd023c79fa1716159867
ff224a5ed96fb61252e8fff7c45936e1afb981ae418b7cf5b0f7d7caf0644d9a
ff7cbd7d791c0f01f1b7db211981bb0506701f663e9e41422586b9e625753ba3

creativedestructionmedia.com Open in urlscan Pro 2606:4700:3030::ac43:bfc6 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

251 Requests

90 %HTTPS

22 %IPv6

66 Domains

101 Subdomains

56 IPs

6 Countries

6540 kBTransfer

12019 kBSize

15 Cookies

50 Outgoing links

Page URL History

Redirected requests

251 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

creativedestructionmedia.com Open in urlscan Pro
2606:4700:3030::ac43:bfc6 Public Scan

Screenshot
Live screenshot

Full Image

251
Requests

90 %
HTTPS

22 %
IPv6

66
Domains

101
Subdomains

56
IPs

6
Countries

6540 kB
Transfer

12019 kB
Size

15
Cookies

251 HTTP transactions
0 data transactions