heraldcourier.com Open in urlscan Pro
192.104.183.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email.mail.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NBQUphaEFwV2hBZ0dNQ0xicEJrdWZHTW5ST3YyTzFvWT0iLCJocmVmIjoiaHR0cHM6...
Effective URL:
https://heraldcourier.com/
Submission: On November 30 via api (November 30th 2023, 4:41:08 pm UTC) from US — Scanned from DE

Summary HTTP 244 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 81 IPs in 9 countries across 64 domains to perform 244 HTTP transactions. The main IP is 192.104.183.109, located in United States and belongs to LEE-ASN, US. The main domain is heraldcourier.com.
TLS certificate: Issued by GTS CA 1P5 on October 31st 2023. Valid for: 3 months.

This is the only time heraldcourier.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:223... 2600:9000:223c:5a00:d:e169:8180:93a1	16509 (AMAZON-02) (AMAZON-02)
9	192.104.183.109 192.104.183.109	10668 (LEE-ASN) (LEE-ASN)
44	104.16.133.24 104.16.133.24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	108.138.1.25 108.138.1.25	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
7	18.65.39.76 18.65.39.76	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:801::2008	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	99.86.4.128 99.86.4.128	16509 (AMAZON-02) (AMAZON-02)
1	23.57.19.78 23.57.19.78	16625 (AKAMAI-AS) (AKAMAI-AS)
2	65.9.66.104 65.9.66.104	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::6816:34ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::ac43:266a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	54.82.88.241 54.82.88.241	14618 (AMAZON-AES) (AMAZON-AES)
3	2606:4700:10:... 2606:4700:10::6816:445	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
3	34.255.67.121 34.255.67.121	16509 (AMAZON-02) (AMAZON-02)
1 2	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1	18.238.17.128 18.238.17.128	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	35.204.89.238 35.204.89.238	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.227.217.72 13.227.217.72	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:209... 2600:9000:2090:400:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
2	13.32.119.77 13.32.119.77	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:225... 2600:9000:2250:7400:a:e047:753:a221	16509 (AMAZON-02) (AMAZON-02)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:209... 2600:9000:2090:d000:10:dd8:5e40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
10	18.204.193.226 18.204.193.226	14618 (AMAZON-AES) (AMAZON-AES)
4	99.86.8.175 99.86.8.175	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:400c:c0b::9b	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	52.17.99.225 52.17.99.225	16509 (AMAZON-02) (AMAZON-02)
2	162.19.138.83 162.19.138.83	16276 (OVH) (OVH)
4	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1 2	34.120.107.143 34.120.107.143	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	54.175.178.6 54.175.178.6	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1f18:730... 2600:1f18:730:b150:8a29:493b:1f46:72ba	14618 (AMAZON-AES) (AMAZON-AES)
1	3.227.126.241 3.227.126.241	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	162.19.138.119 162.19.138.119	16276 (OVH) (OVH)
1	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
1 3	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 9	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2.16.185.46 2.16.185.46	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
12	172.66.42.247 172.66.42.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	44.215.169.187 44.215.169.187	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:480... 2a02:26f0:480:23::1726:62ac	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	44.240.20.156 44.240.20.156	16509 (AMAZON-02) (AMAZON-02)
1 8	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	54.69.251.6 54.69.251.6	16509 (AMAZON-02) (AMAZON-02)
1 1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:1f18:ed:... 2600:1f18:ed:550e:958:d678:1b00:5c96	14618 (AMAZON-AES) (AMAZON-AES)
2	172.66.41.9 172.66.41.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	23.213.165.236 23.213.165.236	16625 (AKAMAI-AS) (AKAMAI-AS)
19 25	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:25e... 2600:9000:25e8:7400:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 5	46.228.174.117 46.228.174.117	56396 (AMOBEE) (AMOBEE)
2 3	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:69f4:eef1:1a8c:a311	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	3.65.68.8 3.65.68.8	16509 (AMAZON-02) (AMAZON-02)
1 1	3.123.68.216 3.123.68.216	16509 (AMAZON-02) (AMAZON-02)
1	18.239.69.3 18.239.69.3	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	18.198.126.47 18.198.126.47	16509 (AMAZON-02) (AMAZON-02)
1	52.70.186.203 52.70.186.203	14618 (AMAZON-AES) (AMAZON-AES)
1	23.192.153.172 23.192.153.172	16625 (AKAMAI-AS) (AKAMAI-AS)
1	216.52.2.91 216.52.2.91	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
2 3	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2 2	3.69.41.2 3.69.41.2	16509 (AMAZON-02) (AMAZON-02)
1	216.52.2.86 216.52.2.86	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
2	37.157.6.232 37.157.6.232	198622 (ADFORM) (ADFORM)
1 1	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
1	54.76.156.92 54.76.156.92	16509 (AMAZON-02) (AMAZON-02)
244	81

1 2600:9000:223c:5a00:d:e169:8180:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

email.mail.heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 192.104.183.109 (United States)

ASN10668 (LEE-ASN, US)
PTR: cms.newyork1.vip.townnews.com

heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

44 104.16.133.24 (None, )

ASN13335 (CLOUDFLARENET, US)

bloximages.newyork1.vip.townnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bloximages.chicago2.vip.townnews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.1.25 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-1-25.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.65.39.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-65-39-76.ams1.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:801::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-128.fra6.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.57.19.78 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-19-78.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.66.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-104.fra56.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:34ad (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.hadronid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.82.88.241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-88-241.compute-1.amazonaws.com

prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6816:445 (United States)

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.255.67.121 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-67-121.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.33.220.150 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.17.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-17-128.ams58.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.204.89.238 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 238.89.204.35.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.217.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-217-72.ams54.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2090:400:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.119.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-119-77.fra60.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:7400:a:e047:753:a221 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2090:d000:10:dd8:5e40:93a1 (United States)

ASN16509 (AMAZON-02, US)

connectid.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 18.204.193.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-204-193-226.compute-1.amazonaws.com

bidder.newspassid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.86.8.175 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-8-175.fra6.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c0b::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.99.225 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-99-225.eu-west-1.compute.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.83 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31532338.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.107.143 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 143.107.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.175.178.6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-178-6.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:8a29:493b:1f46:72ba (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.227.126.241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-126-241.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:3::c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.119 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533570.ip-162-19-138.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.75.62.37 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.185.46 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-16-185-46.deploy.static.akamaitechnologies.com

s.ntv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.66.42.247 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
router.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rt3054.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.215.169.187 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-215-169-187.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:23::1726:62ac (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sli.heraldcourier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 44.240.20.156 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-240-20-156.us-west-2.compute.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.69.251.6 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-69-251-6.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:ed:550e:958:d678:1b00:5c96 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.66.41.9 (United States)

ASN13335 (CLOUDFLARENET, US)

rt3054.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.213.165.236 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-213-165-236.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-jsonp.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 35.204.74.118 (Groningen, Netherlands) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:25e8:7400:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 46.228.174.117 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
usermatch.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.223.111.18 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:69f4:eef1:1a8c:a311 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.65.68.8 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-68-8.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.123.68.216 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-68-216.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.69.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-69-3.ams58.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.198.126.47 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-126-47.eu-central-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.186.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-186-203.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.192.153.172 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-153-172.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.91 (United States)

ASN32475 (SINGLEHOP-LLC, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.180 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.130 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.69.41.2 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-69-41-2.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.86 (United States)

ASN30282 (AS-INAPCDN-OCY, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.6.232 (Denmark)

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.156.92 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-156-92.eu-west-1.compute.amazonaws.com

ad2.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	townnews.com bloximages.newyork1.vip.townnews.com — Cisco Umbrella Rank: 17221 bloximages.chicago2.vip.townnews.com — Cisco Umbrella Rank: 21370	635 KB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4333 i.simpli.fi — Cisco Umbrella Rank: 3745 um.simpli.fi — Cisco Umbrella Rank: 780	12 KB
24	doubleclick.net 3 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 219	226 KB
17	googlesyndication.com 2 redirects a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 148 pagead2.googlesyndication.com — Cisco Umbrella Rank: 102	308 KB
14	infolinks.com resources.infolinks.com — Cisco Umbrella Rank: 7726 router.infolinks.com — Cisco Umbrella Rank: 2762 rt3054.infolinks.com — Cisco Umbrella Rank: 67347	87 KB
11	heraldcourier.com 1 redirects email.mail.heraldcourier.com heraldcourier.com sli.heraldcourier.com	100 KB
10	newspassid.com bidder.newspassid.com — Cisco Umbrella Rank: 23523	37 KB
9	google.com 1 redirects ampcid.google.com — Cisco Umbrella Rank: 2783 region1.analytics.google.com — Cisco Umbrella Rank: 2693 www.google.com — Cisco Umbrella Rank: 2	2 KB
7	adlightning.com tagan.adlightning.com — Cisco Umbrella Rank: 2257	212 KB
6	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2977 rp.liadm.com — Cisco Umbrella Rank: 1632 rp4.liadm.com — Cisco Umbrella Rank: 6685 i.liadm.com — Cisco Umbrella Rank: 517 i6.liadm.com — Cisco Umbrella Rank: 2358	19 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	520 KB
6	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 306 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 614 aax.amazon-adsystem.com — Cisco Umbrella Rank: 410	73 KB
5	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 936	3 KB
5	openx.net 2 redirects oajs.openx.net — Cisco Umbrella Rank: 1639 google-bidout-d.openx.net — Cisco Umbrella Rank: 1643 us-u.openx.net — Cisco Umbrella Rank: 491 rtb.openx.net — Cisco Umbrella Rank: 695	1 KB
5	google.de ampcid.google.de — Cisco Umbrella Rank: 85078 www.google.de — Cisco Umbrella Rank: 6765	1014 B
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	42 KB
5	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 979 bcp.crwdcntrl.net — Cisco Umbrella Rank: 850	25 KB
4	criteo.com 2 redirects gum.criteo.com — Cisco Umbrella Rank: 424 mug.criteo.com — Cisco Umbrella Rank: 2811 dis.criteo.com — Cisco Umbrella Rank: 550	8 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	255 KB
4	segment.com cdn.segment.com — Cisco Umbrella Rank: 1681	35 KB
4	yahoo.com 1 redirects connectid.analytics.yahoo.com — Cisco Umbrella Rank: 4156 ups.analytics.yahoo.com — Cisco Umbrella Rank: 307 cms.analytics.yahoo.com — Cisco Umbrella Rank: 1240	10 KB
4	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 893 id5-sync.com — Cisco Umbrella Rank: 425	67 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	2 KB
3	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 372	935 B
3	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1258 usermatch.targeting.unrulymedia.com — Cisco Umbrella Rank: 4341	378 B
3	matheranalytics.com 1 redirects js.matheranalytics.com — Cisco Umbrella Rank: 11626 www.i.matheranalytics.com — Cisco Umbrella Rank: 11414	43 KB
3	ad.gt id.hadron.ad.gt — Cisco Umbrella Rank: 1673 a.ad.gt — Cisco Umbrella Rank: 1869	4 KB
2	adform.net cm.adform.net — Cisco Umbrella Rank: 1211	211 B
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 336	961 B
2	lijit.com ce.lijit.com — Cisco Umbrella Rank: 835 ap.lijit.com — Cisco Umbrella Rank: 650	588 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 1661	2 KB
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2174	841 B
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 499 d.agkn.com — Cisco Umbrella Rank: 686	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 465	1 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 546	712 B
2	moatads.com z.moatads.com — Cisco Umbrella Rank: 653 s-jsonp.moatads.com — Cisco Umbrella Rank: 17700	55 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	217 B
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 3052 p1.parsely.com — Cisco Umbrella Rank: 2300	21 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	91 KB
2	adsrvr.org 1 redirects insight.adsrvr.org — Cisco Umbrella Rank: 557	237 B
2	amazon.dev prod.us-east-1.cxm-bcn.publisher-services.amazon.dev — Cisco Umbrella Rank: 3667	129 B
2	gstatic.com www.gstatic.com	13 KB
1	360yield.com ad2.360yield.com — Cisco Umbrella Rank: 11022	199 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 339	239 B
1	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 138	545 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 408	98 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 848	445 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1556	421 B
1	intentiq.com sync.intentiq.com — Cisco Umbrella Rank: 846
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6102	175 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 674	236 B
1	segment.io api.segment.io — Cisco Umbrella Rank: 1340	175 B
1	ntv.io s.ntv.io — Cisco Umbrella Rank: 3712	164 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	4 KB
1	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 4118	495 B
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 940	277 B
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 2133	1 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 2789	3 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 631	13 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 1740	8 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 313	1 KB
1	cloudfront.net d1eoo1tco6rr5e.cloudfront.net	668 B
1	hadronid.net cdn.hadronid.net — Cisco Umbrella Rank: 1790	10 KB
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1042	17 KB
244	64

	Domain	Requested by
42	bloximages.newyork1.vip.townnews.com	heraldcourier.com bloximages.newyork1.vip.townnews.com
25	um.simpli.fi	19 redirects
17	securepubads.g.doubleclick.net	heraldcourier.com tagan.adlightning.com securepubads.g.doubleclick.net
10	bidder.newspassid.com	bloximages.newyork1.vip.townnews.com bidder.newspassid.com
9	tpc.googlesyndication.com	2 redirects heraldcourier.com tagan.adlightning.com
9	heraldcourier.com	heraldcourier.com
7	pagead2.googlesyndication.com	heraldcourier.com securepubads.g.doubleclick.net tagan.adlightning.com tpc.googlesyndication.com
7	tagan.adlightning.com	heraldcourier.com tagan.adlightning.com
6	resources.infolinks.com	tagan.adlightning.com blank
6	www.googletagmanager.com	heraldcourier.com www.googletagmanager.com
5	rt3054.infolinks.com	resources.infolinks.com tagan.adlightning.com
5	jadserve.postrelease.com	tagan.adlightning.com heraldcourier.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	www.google.com	1 redirects heraldcourier.com tagan.adlightning.com
4	www.googletagservices.com	tagan.adlightning.com
4	www.google.de	heraldcourier.com
4	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
4	region1.analytics.google.com	www.googletagmanager.com
4	cdn.segment.com	heraldcourier.com cdn.segment.com tagan.adlightning.com
3	ib.adnxs.com	2 redirects
3	eb2.3lift.com	2 redirects
3	router.infolinks.com	resources.infolinks.com tagan.adlightning.com
3	bcp.crwdcntrl.net	tags.crwdcntrl.net
3	c.amazon-adsystem.com	heraldcourier.com c.amazon-adsystem.com
2	usermatch.targeting.unrulymedia.com	bidder.newspassid.com
2	cm.adform.net	bidder.newspassid.com
2	x.bidswitch.net	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	pixel.tapad.com	1 redirects
2	sync.1rx.io	2 redirects
2	i.liadm.com	tagan.adlightning.com i.liadm.com
2	www.facebook.com	heraldcourier.com
2	ups.analytics.yahoo.com	connectid.analytics.yahoo.com
2	gum.criteo.com	1 redirects tagan.adlightning.com
2	oajs.openx.net	1 redirects heraldcourier.com
2	id5-sync.com	cdn.id5-sync.com
2	aax.amazon-adsystem.com	c.amazon-adsystem.com
2	js.matheranalytics.com	1 redirects heraldcourier.com
2	connect.facebook.net	heraldcourier.com connect.facebook.net
2	insight.adsrvr.org	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	id.hadron.ad.gt	cdn.hadronid.net
2	prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	c.amazon-adsystem.com
2	cdn.id5-sync.com	heraldcourier.com tagan.adlightning.com
2	tags.crwdcntrl.net	heraldcourier.com tagan.adlightning.com
2	www.gstatic.com	heraldcourier.com
2	bloximages.chicago2.vip.townnews.com	heraldcourier.com
1	ad2.360yield.com
1	rtb.openx.net	1 redirects
1	ap.lijit.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	googleads.g.doubleclick.net	1 redirects
1	www.googleadservices.com	1 redirects
1	idsync.rlcdn.com
1	ce.lijit.com
1	stags.bluekai.com
1	sync.bfmio.com
1	cms.analytics.yahoo.com	1 redirects
1	sync.intentiq.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	sync.targeting.unrulymedia.com
1	s.ad.smaato.net
1	i.simpli.fi	tagan.adlightning.com
1	s-jsonp.moatads.com	heraldcourier.com
1	z.moatads.com	tagan.adlightning.com
1	i6.liadm.com	i.liadm.com
1	dis.criteo.com	1 redirects
1	api.segment.io	cdn.segment.com
1	sli.heraldcourier.com	heraldcourier.com
1	google-bidout-d.openx.net	tagan.adlightning.com
1	s.ntv.io	tagan.adlightning.com
1	mug.criteo.com	heraldcourier.com
1	cdnjs.cloudflare.com	bloximages.newyork1.vip.townnews.com
1	esp.rtbhouse.com	invstatic101.creativecdn.com
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	rp4.liadm.com	heraldcourier.com
1	rp.liadm.com	1 redirects
1	www.i.matheranalytics.com	heraldcourier.com
1	p1.parsely.com	heraldcourier.com
1	ampcid.google.de	www.google-analytics.com
1	a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	connectid.analytics.yahoo.com	tagan.adlightning.com
1	invstatic101.creativecdn.com	tagan.adlightning.com
1	cdn.prod.uidapi.com	tagan.adlightning.com
1	static.criteo.net	tagan.adlightning.com
1	oa.openxcdn.net	tagan.adlightning.com
1	cdn.jsdelivr.net	tagan.adlightning.com
1	ampcid.google.com	www.google-analytics.com
1	a.ad.gt	tagan.adlightning.com
1	b-code.liadm.com	www.googletagmanager.com
1	cdn.parsely.com	www.googletagmanager.com
1	tag.simpli.fi	www.googletagmanager.com
1	d1eoo1tco6rr5e.cloudfront.net	www.googletagmanager.com
1	cdn.hadronid.net	heraldcourier.com
1	secure.cdn.fastclick.net	heraldcourier.com
1	config.aps.amazon-adsystem.com	c.amazon-adsystem.com
1	email.mail.heraldcourier.com	1 redirects
244	101

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
subscriberservicesdsi.lee.net
legacy.memoriams.com
www.stringr.com
www.google.com
swvatoday.com
us59.dayforcehcm.com
bloxcms.com
bloxdigital.com

Subject Issuer	Validity	Valid
heraldcourier.com GTS CA 1P5	`2023-10-31` - `2024-01-29`	3 months	crt.sh
bloximages.chicago2.vip.townnews.com GeoTrust TLS RSA CA G1	`2023-03-13` - `2024-04-12`	a year	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.adlightning.com Amazon RSA 2048 M01	`2023-07-08` - `2024-08-05`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2023-02-20` - `2024-03-20`	a year	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2023-10-03` - `2024-10-03`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M01	`2023-10-08` - `2024-11-05`	a year	crt.sh
hadronid.net GTS CA 1P5	`2023-10-05` - `2024-01-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-07` - `2024-05-06`	a year	crt.sh
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev Amazon RSA 2048 M02	`2023-11-27` - `2024-12-25`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-08` - `2023-12-07`	3 months	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
*.parsely.com Amazon RSA 2048 M02	`2023-05-06` - `2024-06-03`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M02	`2023-02-28` - `2024-01-30`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-11-24` - `2024-02-22`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
cdn.prod.uidapi.com R3	`2023-11-02` - `2024-01-31`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-10-24` - `2024-01-22`	3 months	crt.sh
connectid.analytics.yahoo.com GlobalSign ECC OV SSL CA 2018	`2023-08-15` - `2024-02-08`	6 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
bidder.newspassid.com Amazon RSA 2048 M01	`2023-05-03` - `2024-05-31`	a year	crt.sh
*.segment.com Amazon RSA 2048 M03	`2023-11-14` - `2024-12-13`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.id5-sync.com R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
www.i.matheranalytics.com Amazon RSA 2048 M03	`2023-11-15` - `2024-12-14`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2023-12-23`	3 months	crt.sh
*.eu-1-id5-sync.com R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-11-08` - `2024-02-06`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-03` - `2024-01-24`	6 months	crt.sh
*.ntv.io DigiCert TLS RSA SHA256 2020 CA1	`2023-08-28` - `2024-08-28`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
sli.leetemplates.com R3	`2023-10-05` - `2024-01-03`	3 months	crt.sh
*.postrelease.com Amazon RSA 2048 M02	`2023-08-30` - `2024-09-28`	a year	crt.sh
*.segment.io Amazon RSA 2048 M01	`2023-02-10` - `2024-02-10`	a year	crt.sh
moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-25` - `2024-10-24`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2023-05-06` - `2024-05-04`	a year	crt.sh
*.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-25` - `2024-06-18`	a year	crt.sh
*.targeting.unrulymedia.com Sectigo RSA Domain Validation Secure Server CA	`2023-05-10` - `2024-05-10`	a year	crt.sh
*.360yield.com Amazon RSA 2048 M01	`2023-05-29` - `2024-06-26`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://heraldcourier.com/
Frame ID: C9BA5588C2F3C30502B111FDF85F60A4
Requests: 186 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Frame ID: 9AA9CB74A3C56868B1F0434552DFEA83
Requests: 2 HTTP requests in this frame

Frame: https://a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: F12ECB392E4C345C8E21F9D18304AFA3
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: DFB6CDB3CE801C0247E64FEA5D6D6E4F
Requests: 4 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=heraldcourier.com
Frame ID: 18CA4C798090B6F9DB051EE3C8632AAA
Requests: 2 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: A7F8623B25E6FF2B5F7997C688A35716
Requests: 9 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: F9CD7B72A1699F21C436557CC87D25A0
Requests: 8 HTTP requests in this frame

Frame: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Frame ID: E9CB33A12AC9A9553E53780D1AE3E3B0
Requests: 9 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: CB3C0AD2E7D779E7F9AABBDAC1E13FAA
Requests: 1 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&euns=0&s=&version=v2.11.1&
Frame ID: E62FBCE6890E4EAAC9B3C65986F5E5C7
Requests: 3 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3384910&wsid=0&pdom=heraldcourier.com&purl=https%3A%2F%2Fheraldcourier.com%2F
Frame ID: 75272C361C3587A18CCD76A66C7F5550
Requests: 1 HTTP requests in this frame

Frame: https://resources.infolinks.com/static/brands/adidas_2_728x90.jpg
Frame ID: 1CAE34D593C619415C8EB5FAE2E69FA4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E05ED9E5002ABCC87430AC88F76CF0F9
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0C8FFDD0FA45693B39817128A5C63D35
Requests: 2 HTTP requests in this frame

Frame: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
Frame ID: B0CD9D8B0EDB8ABAE5EE375531D30091
Requests: 8 HTTP requests in this frame

Frame: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459292&bidder=newspassid
Frame ID: EEE2C8A25F857B86ED2109367E423E90
Requests: 4 HTTP requests in this frame

Frame: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Frame ID: 01473DB1B7A3DB772C867E96D11D9E8F
Requests: 1 HTTP requests in this frame

Frame: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Frame ID: B38C7F1FB6A3E9694A0321D51C338914
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bristol Herald Courier | Breaking News | | Read Bristol, VA and Virginia breaking news. Get latest news, events and information on Virginia sports, weather, entertainment and lifestylesVideoVideoVideoVideoAudioAudioAudioAudioVideoVideoVideoCollectionCollectionCollectionCollection

Page URL History Show full URLs

https://email.mail.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NBQUphaEFwV2hBZ0dNQ0xicEJrdWZHTW5ST3YyTzFvWT0i... HTTP 302
https://heraldcourier.com/ Page URL

Detected technologies

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

owl\.carousel.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

244
Requests

88 %
HTTPS

37 %
IPv6

64
Domains

101
Subdomains

81
IPs

9
Countries

3120 kB
Transfer

8987 kB
Size

63
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuw9yEMM5At-FTE9v-PzbRCHT00ZaWnRxouWXCugcJXyyeUscR9J4NuU8VSdQ-_Yy561-qn-xXahM-dmjA-aZtS-9tsmCvMzkVaqwEy4xFxUGr5ZXvYc6ZyXy5AK-QQS3EbLgjAthN4VzNYjmrebatfyonekdK0Ub8Llg34F90hyn__jIDxzHqWmQB1MdrPqmSATxPwthBQm87XWtuN5xUXmhtgUT7peP95prNZfLZ8qF-b8n-H0x9EcG8-yuoeODMbumaV6zHNwpedUFhbtBl8pYAFZBeo8QI3RcNFI9jAEPtiMeaUPR8lw4P9H9qUzWkkf5BOqO465-QkYPQZqe_daEY%2526sai%253DAMfl-YShJZ6Vef66P4kjYotAW3MRCh9swHkXAEqxpdmTO3tBMrYlr4AO4j0GB4yrkITnXlsi1_2cwGcPZjKbgk8a7pskcuPN_FvdAgoqHEVIoF_DkJII-OyYSyEchLcY54Y-L4Bfwq6Q8Kv8eAM00asMQ0iS4iTpZ7k56gYCng%2526sig%253DCg0ArKJSzJYnqbRED1k3EAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253Dhttp://www.theveincompany.com

Search URL Search Domain Scan URL

URL: https://subscriberservicesdsi.lee.net/subscriberservices/Content/paymentpagesingle.aspx?Domain=heraldcourier.com&SubscriberLevel=DOP&Return=https%3A%2F%2Fheraldcourier.com%2F#tracking-source=header&ir=true
Title: Subscribe $1 for 6 months

Search URL Search Domain Scan URL

URL: https://legacy.memoriams.com/network/BristolHeraldCourier/Obituaries?online=1&utm_campaign=consumerdirect&utm_source=lee&utm_medium=np_s&utm_content=heraldcourier
Title: Share a story

Search URL Search Domain Scan URL

URL: https://www.stringr.com/xlFFejdUIVF
Title: Share video

Search URL Search Domain Scan URL

URL: https://subscriberservicesdsi.lee.net/subscriberservices/Content/AccountStatus.aspx?Domain=heraldcourier.com
Title: My Subscription

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//733%20ZION%20CHURCH%20RC%2BCROCKETT%2BVA%2B24323
Title: 733 ZION CHURCH RC, CROCKETT, VA 24323

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//4127%20CHAPMAN%20ROAD%2BMAX%20MEADOWS%2BVA%2B24360
Title: 4127 CHAPMAN ROAD, MAX MEADOWS, VA 24360

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/dir//610%20FIELDCREST%20CIRCLE%2BTAZEWELL%2BVA%2B24651
Title: 610 FIELDCREST CIRCLE, TAZEWELL, VA 24651

Search URL Search Domain Scan URL

URL: https://swvatoday.com/
Title: SWVA Today

Search URL Search Domain Scan URL

URL: https://us59.dayforcehcm.com/CandidatePortal/en-US/leeenterprises/SITE/CANDIDATEPORTAL
Title: Join Our Team

Search URL Search Domain Scan URL

URL: https://bloxcms.com/
Title: BLOX Content Management System

Search URL Search Domain Scan URL

URL: https://bloxdigital.com/
Title: bloxdigital.com

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email.mail.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NBQUphaEFwV2hBZ0dNQ0xicEJrdWZHTW5ST3YyTzFvWT0iLCJocmVmIjoiaHR0cHM6Ly9oZXJhbGRjb3VyaWVyLmNvbS8iLCJpbnRlcm5hbCI6ImNlZjMwNzAxZTUzNjk2YTEwMiIsImxpbmtfaWQiOjI4MH0/2773fa217f99d953ea9dc20e16047b0c9a52e4c47c1b85943ee7f1a3875590d9 HTTP 302
https://heraldcourier.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65

https://insight.adsrvr.org/tags/nebsjkp/21usqg2/iframe HTTP 301
https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

Request Chain 72

https://js.matheranalytics.com/s/ma1527/725149306/lee/ml.js?cb=1641 HTTP 301
https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js

Request Chain 113

https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1

Request Chain 115

https://rp.liadm.com/j?dtstmp=1701362459097&aid=a-058n&se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&tna=v2.11.1&pu=https%3A%2F%2Fheraldcourier.com%2F&ext__pubcid=65698af0-cc65-4662-8556-6cffe80f7401&wpn=lc-bundle&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0yIj5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-QXVkaW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xMyI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE0Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTUiPkNvbGxlY3Rpb248L3RpdGxlPg HTTP 302
https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&aid=a-058n&tna=v2.11.1&dtstmp=1701362459097&n3pc=true&wpn=lc-bundle&ext__pubcid=65698af0-cc65-4662-8556-6cffe80f7401&i6=MmEwMTo0YTA6NWE6OjEw&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0yIj5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-QXVkaW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xMyI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE0Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTUiPkNvbGxlY3Rpb248L3RpdGxlPg

Request Chain 133

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrf2_VRABGAEyCFhQrjHgP-WC HTTP 301
https://tpc.googlesyndication.com/simgad/1369886636433257115

Request Chain 134

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrfPo3AEQARgBMgjIkoSCyqD0Kw HTTP 301
https://tpc.googlesyndication.com/simgad/4135096395794578540

Request Chain 136

https://gum.criteo.com/sid/json?origin=publishertagids&domain=heraldcourier.com&sn=ChromeSyncframe&so=0&topUrl=heraldcourier.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=4hpCh3wybUtoRy96UXdnSDltTVY2d0dsamlCMUNCS09ZM3BWZVlyT0JiSTJHcjBKQ1V4NHFLajZsbmhseFFER0UrWjNrT1RpSkFoczdub09lZkxNT1NudnN2NzFSRlMya2tudGRkbFdLZHcydllnSjZOZWZjZWtLT0FMYVRoNjlySkFuUUhkVnRySGN2QytoMzU5NnpSejZLbTYwQXJZb3FwWXJ5cGpSWHEwYjVibHZYV1ZqVDNpdWswWTVzbnAwZ1pjNHhtcFhTMDdPK0twQ2dhU1V5VGNQVTFvLzJUeVdNSjVNcjd5OEwzSHBsR2RlQVorQUp2SmxiVU01Ri9qcEh6WDIrekUvVTZpRmVNc0ZWNXFpbW1JMndXZz09fA&cppv=2

Request Chain 182

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@ HTTP 302
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-xXJkFJEhQNgA6f_PKaBmjYCstYZshM39Cgf4Hg

Request Chain 198

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 199

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/56EE9B2FA1994B1F85BFF04DE3320928 HTTP 302
https://sync.1rx.io/usersync/simplifi/56EE9B2FA1994B1F85BFF04DE3320928?zcc=1&cb=1701362462455 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003

Request Chain 200

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=56EE9B2FA1994B1F85BFF04DE3320928&dongle=yf3

Request Chain 201

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 202

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 203

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=56EE9B2FA1994B1F85BFF04DE3320928 HTTP 302
https://d.agkn.com/pixel/10751/?che=1701362462287&ip=80.255.10.199&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217523104716003380185 HTTP 302
https://um.simpli.fi/aa_px?sk=217523104716003380185 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 204

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 207

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=56EE9B2FA1994B1F85BFF04DE3320928;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=56EE9B2FA1994B1F85BFF04DE3320928;mimetype=img;sr HTTP 302
https://cms.analytics.yahoo.com/cms?partner_id=DATCS HTTP 302
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

Request Chain 208

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0&xl8blockcheck=1

Request Chain 210

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 211

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 212

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 213

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 214

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 215

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701362462168&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=HrtoZdX0DYeu7_UPxsipsAc&sscte=1&crd=&pscrd=IhMI1fvHiZXsggMVB9e7CB1GZAp2 HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHiZXsggMVB9e7CB1GZAp2&is_vtc=1&ocp_id=HrtoZdX0DYeu7_UPxsipsAc&cid=CAQSKQDICaaNJYCA8Mf5hWLJ9EtA8ZGTqUivgmAFWkKYRcd1PReiWB9k8hJC&random=1714407932 HTTP 302
https://www.google.de/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHiZXsggMVB9e7CB1GZAp2&is_vtc=1&ocp_id=HrtoZdX0DYeu7_UPxsipsAc&cid=CAQSKQDICaaNJYCA8Mf5hWLJ9EtA8ZGTqUivgmAFWkKYRcd1PReiWB9k8hJC&random=1714407932&ipr=y

Request Chain 217

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=56EE9B2FA1994B1F85BFF04DE3320928 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 218

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=56EE9B2FA1994B1F85BFF04DE3320928&expires=365

Request Chain 219

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=56EE9B2FA1994B1F85BFF04DE3320928

Request Chain 220

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEGwjfcyTaJ6jmLitaocF0Ko&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=56EE9B2FA1994B1F85BFF04DE3320928 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 231

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid HTTP 302
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid HTTP 302
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=d7a43f51-37ba-45e9-9c63-2de50a337b7b

Request Chain 233

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=4119821668793550965332

Request Chain 239

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=3827925611282904487

Request Chain 242

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D HTTP 302
https://bidder.newspassid.com/setuid?bidder=openx&uid=6f69e616-5704-49ea-9292-5483bee36805

244 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
heraldcourier.com/
Redirect Chain

https://email.mail.heraldcourier.com/e/c/eyJlbWFpbF9pZCI6ImRnVE84d2NBQUphaEFwV2hBZ0dNQ0xicEJrdWZHTW5ST3YyTzFvWT0iLCJocmVmIjoiaHR0cHM6Ly9oZXJhbGRjb3VyaWVyLmNvbS8iLCJpbnRlcm5hbCI6ImNlZjMwNzAxZTUzNjk2...
https://heraldcourier.com/

531 KB
62 KB

518ms
168ms

Document
text/html

192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.104.183.109 , United States, ASN10668 (LEE-ASN, US),

Reverse DNS

cms.newyork1.vip.townnews.com

Software

Resource Hash

389a36037c6d075103bfbba79fbe57d145c3203dc98e51f1f929408ae2155834

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2129
cache-control: public, max-age=10
content-encoding: gzip
content-length: 61726
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 30 Nov 2023 16:05:27 GMT
etag: W/526edac6c1a63f3e72ae1baa859cf99f
last-modified: Thu, 30 Nov 2023 16:05:25 GMT
link: <https://bloximages.newyork1.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js>; rel=preload; as=script </shared-content/art/tncms/user/user.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.3c64d611e594b45dd35b935162e79d85.js>; rel=preload; as=script <https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js>; rel=preload; as=script
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: X-IPCountry, X-Townnews-Now-API-Version, Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-loop: 1
x-robots-tag: noarchive
x-tncms: 1.71.9; app3; 1.66s; 7.1M
x-ua-compatible: IE=edge
x-vcache: HIT
x-xrds-location: https://heraldcourier.com/tncms/xrds/
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
date: Thu, 30 Nov 2023 16:40:56 GMT
location: https://heraldcourier.com/
via: 1.1 google, 1.1 50c53efe331c3da25a4faf191817af8c.cloudfront.net (CloudFront)
x-amz-cf-id: Eu6WHZZYcBMoafucY4ndnrovm4MOsG3-TD7-S7v5Nhn8kOJscwIH9A==
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront

GET
H2 200 jquery.min.d6d18fcf88750a16d256e72626e676a6.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/ 98 KB
34 KB 164ms
30ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 143879
cross-origin-resource-policy: cross-origin
last-modified: Wed, 07 Jul 2021 20:09:22 GMT
x-vcache: MISS
server: cloudflare
etag: W/"60e609f2-1882c"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed957904c-FRA
expires: Wed, 30 Oct 2024 07:39:49 GMT

GET
H2 200 user.js Show response
heraldcourier.com/shared-content/art/tncms/user/ 3 KB
2 KB 88ms
87ms Script
application/x-javascript 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/user/user.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: 32209e964449881b7f2a21086506deccc49063673c2cfff6288598f843fc81c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:37:54 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 182
etag: W/"65568d4d-c46"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 1437
service-worker-allowed: /

GET
H2 200 bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/ 39 KB
11 KB 164ms
31ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/scripts/bootstrap.min.d457560d3dfbf1d56a225eb99d7b0702.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1817897
cross-origin-resource-policy: cross-origin
last-modified: Fri, 06 Sep 2019 14:16:03 GMT
x-vcache: MISS
server: cloudflare
etag: W/"5d726a23-9bd8"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed961904c-FRA
expires: Wed, 27 Mar 2024 12:09:19 GMT

GET
H2 200 common.08a61544f369cc43bf02e71b2d10d49f.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 32 KB
12 KB 156ms
23ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/common.08a61544f369cc43bf02e71b2d10d49f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd1991e3d8ce67431989f8cca95743706d110f064ed2b3609041a3f20e50d2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2621529
cross-origin-resource-policy: cross-origin
last-modified: Thu, 16 Mar 2023 19:39:17 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64137065-8154"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed95d904c-FRA
expires: Thu, 21 Mar 2024 06:45:40 GMT

GET
H2 200 tnt.ee95c0b6f1daceb31bf5ef84353968c6.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 11 KB
4 KB 154ms
21ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.ee95c0b6f1daceb31bf5ef84353968c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2442822
cross-origin-resource-policy: cross-origin
last-modified: Thu, 10 Aug 2023 18:23:36 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64d52b28-2d77"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed958904c-FRA
expires: Wed, 14 Aug 2024 19:01:34 GMT

GET
H2 200 application.3c64d611e594b45dd35b935162e79d85.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 4 KB
2 KB 162ms
29ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/application.3c64d611e594b45dd35b935162e79d85.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

076f281a9257ad662f34badb12393195fdca0dc2fde9acd1f1628b9674a96aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1815721
cross-origin-resource-policy: cross-origin
last-modified: Fri, 23 Jun 2023 18:40:28 GMT
x-vcache: MISS
server: cloudflare
etag: W/"6495e71c-10fa"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed95f904c-FRA
expires: Sat, 22 Jun 2024 19:01:35 GMT

GET
H2 200 tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 2 KB
957 B 158ms
26ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.navigation.accessibility.7a9170240d21440159b9bd59db72933b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 182433
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Oct 2023 21:37:38 GMT
x-vcache: MISS
server: cloudflare
etag: W/"653c2da2-9b8"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed963904c-FRA
expires: Fri, 01 Nov 2024 08:08:59 GMT

GET
H2 200 bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/ 107 KB
18 KB 152ms
22ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/bootstrap/resources/styles/bootstrap.min.87df60d54091cf1e8f8173c2e568260c.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1855473
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Oct 2023 21:37:37 GMT
x-vcache: MISS
server: cloudflare
etag: W/"653c2da1-1ac2e"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed945904c-FRA
expires: Thu, 31 Oct 2024 06:21:08 GMT

GET
H2 200 layout.9509b461cedc7767649ee83a5b35c177.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/ 154 KB
28 KB 158ms
28ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/styles/layout.9509b461cedc7767649ee83a5b35c177.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd2c680964b28dc283f3518e21720cd2f886e7bdb8d2f5b47809ef836c337d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 143880
cross-origin-resource-policy: cross-origin
last-modified: Mon, 27 Nov 2023 14:35:16 GMT
x-vcache: MISS
server: cloudflare
etag: W/"6564a924-26683"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed949904c-FRA
expires: Wed, 27 Nov 2024 20:01:22 GMT

GET
H2 200 lee.ds.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/ 97 KB
17 KB 248ms
118ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701327605

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5c357a5e69089e5088279fc5aaa5663d088815b3408a005dd6bc93b50bf7745

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
cross-origin-resource-policy: cross-origin
last-modified: Thu, 30 Nov 2023 07:00:05 GMT
x-vcache: HIT
server: cloudflare
etag: W/"656832f5-18487"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed94b904c-FRA
expires: Fri, 29 Nov 2024 07:05:40 GMT

GET
H2 200 flex-notification-controls.e115619c5ab5d4eb38fbd29cc0d2ea9b.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/styles/ 6 KB
2 KB 155ms
26ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/block/resources/styles/flex-notification-controls.e115619c5ab5d4eb38fbd29cc0d2ea9b.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a77010a20c4a6611c4230df5afe003914255a35909daabaaa5a8f0427c73eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2459052
cross-origin-resource-policy: cross-origin
last-modified: Mon, 17 Jul 2023 20:19:11 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64b5a23f-183e"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed94c904c-FRA
expires: Thu, 25 Jul 2024 08:52:47 GMT

GET
H2 200 owl.carousel.d631cca58a0d014854c4a6c1815f1da3.css
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/styles/ 5 KB
1 KB 149ms
20ms Stylesheet
text/css 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/styles/owl.carousel.d631cca58a0d014854c4a6c1815f1da3.css

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b93740066fadbde00a03ff560765bd25b8e9ca74f7774a4633f61ce44b332991

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2525864
cross-origin-resource-policy: cross-origin
last-modified: Fri, 13 Oct 2023 13:11:35 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65294207-12c4"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed94d904c-FRA
expires: Wed, 30 Oct 2024 06:28:53 GMT

GET
H2 200 access.d7adebba498598b0ec2c.js Show response
heraldcourier.com/shared-content/art/tncms/api/ 70 KB
29 KB 116ms
113ms Script
application/x-javascript 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/api/access.d7adebba498598b0ec2c.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: 8e683a0ae8fc37aeae8fd20643faef0341fe5cf01c30f25f41d6bad28b1a8365

Request headers

Referer: https://heraldcourier.com/
Origin: https://heraldcourier.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:37:54 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 14:48:42 GMT
x-vcache: HIT
age: 182
etag: W/"654b9fca-1164b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 29242
service-worker-allowed: /

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 267 KB
65 KB 39ms
8ms Script
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 15:44:00 GMT
content-encoding: gzip
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f4.cloudfront.net (CloudFront), 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
last-modified: Mon, 13 Nov 2023 20:18:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
age: 3418
x-amz-server-side-encryption: AES256
etag: W/"2d08dd94de483579c1dc3f3783c06f6e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: 2o0QViCmMf4ShTHug2yA055PjN0Vijy-KVknK9ndjQI8RBXIIhqzSg==

GET
H2 200 heraldcourier.com.js Show response
bloximages.chicago2.vip.townnews.com/leetemplates.com/content/tncms/live/global/resources/scripts/falcon/ 6 KB
2 KB 254ms
111ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.chicago2.vip.townnews.com/leetemplates.com/content/tncms/live/global/resources/scripts/falcon/heraldcourier.com.js?_dc=1701360325

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a31894ecca45b8d1c2a155ceca79ba3acbb405e81e179d6949bd75d6e54dd55

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
cross-origin-resource-policy: cross-origin
last-modified: Thu, 30 Nov 2023 06:01:56 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65682554-178c"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fee96c9bf5-FRA
expires: Fri, 29 Nov 2024 16:09:27 GMT

GET
H2 200 owl.carousel.50dc41fa734414148ce4b489fd904c5f.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 40 KB
11 KB 165ms
37ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/owl.carousel.50dc41fa734414148ce4b489fd904c5f.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1794ab1a330fa566f4f21116012908a58001e21fb254959ac7cbcd41b25bba34

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1758345
cross-origin-resource-policy: cross-origin
last-modified: Wed, 29 Mar 2023 16:34:24 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64246890-9ff8"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed966904c-FRA
expires: Wed, 03 Apr 2024 07:42:18 GMT

GET
H2 200 tnt.notify.a814fe612f2dcba9061edc229aeaf90b.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 3 KB
1 KB 22ms
22ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/tnt.notify.a814fe612f2dcba9061edc229aeaf90b.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4dc723b7dd6602e39eb50fa74c7df276cb468805f5fae7450b00b8a568973a09

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 24441
cross-origin-resource-policy: cross-origin
last-modified: Mon, 27 Nov 2023 14:35:13 GMT
x-vcache: MISS
server: cloudflare
etag: W/"6564a921-dbe"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488ffea9d904c-FRA
expires: Thu, 28 Nov 2024 08:38:46 GMT

GET
H2 200 tnt.notify.panel.bacbeac9a1ca6ee75b79b21a0e2e99f2.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/template/resources/scripts/ 7 KB
2 KB 26ms
19ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b6854831be14d28fdfdb1758ebebe2893bf8e5be5f176b8d3e1b1b0f874d90e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 2621529
cross-origin-resource-policy: cross-origin
last-modified: Wed, 29 Mar 2023 16:33:56 GMT
x-vcache: MISS
server: cloudflare
etag: W/"64246874-1ba0"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e489000ac4904c-FRA
expires: Tue, 02 Apr 2024 18:06:23 GMT

GET
H2 200 firebase-app.js Show response
www.gstatic.com/firebasejs/6.6.2/ 11 KB
4 KB 47ms
13ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/6.6.2/firebase-app.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b10a075758097bb0578287af03c76a9fcd82fa4607587109ae41fe2d24756600

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 03:32:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3945
x-xss-protection: 0
last-modified: Thu, 19 Sep 2019 21:11:52 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 29 Nov 2024 03:32:23 GMT

GET
H2 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/6.6.2/ 31 KB
9 KB 48ms
14ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/6.6.2/firebase-messaging.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5e55a21dfa3a20ceb298737c8f4c517a83d7960468c7f53b3f33c567bacff3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 01:34:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486364
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8653
x-xss-protection: 0
last-modified: Thu, 19 Sep 2019 21:11:54 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Nov 2024 01:34:53 GMT

GET
H2 200 messaging.js Show response
heraldcourier.com/shared-content/art/tncms/api/ 2 KB
1 KB 91ms
84ms Script
application/x-javascript 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/api/messaging.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: adfa39b53589a91e67b4d82766750bee32371b51438f41dfbd6da0764719370e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:38:47 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 130
etag: W/"65568d4d-9cb"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 885
service-worker-allowed: /

GET
H2 200 tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/ 207 B
282 B 153ms
25ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/ads/resources/scripts/tnt.ads.adverts.66a3812a7b5c12fde8cd998fd691ad7d.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1082160
cross-origin-resource-policy: cross-origin
last-modified: Fri, 13 Oct 2023 13:11:34 GMT
x-vcache: MISS
server: cloudflare
etag: W/"65294206-cf"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed964904c-FRA
expires: Wed, 30 Oct 2024 08:12:09 GMT

GET
H2 200 tracking.js Show response
heraldcourier.com/shared-content/art/tncms/ 3 KB
1 KB 162ms
160ms Script
application/x-javascript 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:37:54 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 21:44:45 GMT
x-vcache: HIT
age: 182
etag: W/"65568d4d-a3a"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 1157
service-worker-allowed: /

GET
H2 200 prebid7.9.0.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/ 197 KB
61 KB 159ms
32ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77b109dd53ec2921d47af5eedcf39cbea8bc92bf8b59a970aa104c5ed2d5b3c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1688102
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:29 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9271-313f5"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed955904c-FRA
expires: Thu, 03 Oct 2024 16:32:56 GMT

GET
H2 200 lee.common.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/scripts/ 9 KB
3 KB 246ms
119ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/scripts/lee.common.js?_dc=1701327605

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2008966819bb51e24bb6cbf82ef28efeb4d678e20c3b61fc02bb5d45b45e74e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
cross-origin-resource-policy: cross-origin
last-modified: Thu, 30 Nov 2023 07:00:05 GMT
x-vcache: HIT
server: cloudflare
etag: W/"656832f5-2459"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488fed950904c-FRA
expires: Fri, 29 Nov 2024 07:05:40 GMT

GET
H2 200 fontawesome.568f3d1ab17b33ce05854081baadadac.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/ 268 KB
98 KB 35ms
29ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/plugins/resources/scripts/fontawesome.568f3d1ab17b33ce05854081baadadac.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7976a9dfe57f9ba6972420500782258da674fcc523c2def08bb6a84ce275c4b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1509424
cross-origin-resource-policy: cross-origin
last-modified: Thu, 09 Nov 2023 15:29:53 GMT
x-vcache: MISS
server: cloudflare
etag: W/"654cfaf1-43130"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e489000ac5904c-FRA
expires: Tue, 12 Nov 2024 04:30:11 GMT

GET
H2 200 tracker.js Show response
heraldcourier.com/shared-content/art/stats/common/ 9 KB
3 KB 160ms
159ms Script
application/x-javascript 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/shared-content/art/stats/common/tracker.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:37:54 GMT
content-encoding: gzip
last-modified: Wed, 08 Nov 2023 08:22:23 GMT
x-vcache: HIT
age: 182
etag: W/"654b453f-2200"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=600
accept-ranges: bytes
content-length: 3224
service-worker-allowed: /

GET
H2 200 e0d66240-6be2-11ec-a380-ff649233b50f.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/custom/image/ 4 KB
4 KB 22ms
6ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/custom/image/e0d66240-6be2-11ec-a380-ff649233b50f.png

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e88bc41dfc3e11b318a5a3eeeb403b70f98705db64962f4647a3ad2cb9083aa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 29361
cf-polished: origFmt=png, origSize=5857
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="e0d66240-6be2-11ec-a380-ff649233b50f.webp"
content-length: 4166
cf-bgj: imgq:85,h2pri
last-modified: Sun, 02 Jan 2022 15:44:32 GMT
server: cloudflare
x-vcache: MISS
etag: "61d1c860-16e1"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e488ff098e904c-FRA
expires: Thu, 31 Oct 2024 10:36:20 GMT

GET
H2 200 user_no_avatar.82c8fc38eb25dca10493a994ca1bfb90.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/images/ 978 B
1 KB 22ms
16ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/themes/resources/images/user_no_avatar.82c8fc38eb25dca10493a994ca1bfb90.png

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b96eb73da5fe3c20e4507bf752917f6d7978be8881c1dea934db282b028407d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 1811979
cf-polished: origFmt=png, origSize=3610
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="user_no_avatar.webp"
content-length: 978
cf-bgj: imgq:85,h2pri
last-modified: Thu, 02 Apr 2015 21:53:54 GMT
server: cloudflare
x-vcache: MISS
etag: "551dba72-e1a"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489000ac7904c-FRA
expires: Tue, 15 Oct 2024 16:37:45 GMT

GET
H2 200 logo-tagline.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/ 5 KB
5 KB 25ms
9ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/logo-tagline.png?_dc=1701327605

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c01c1e199879f8b72679cc4d402684ba9e88c21b633547adbae6ba03a617fdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 2194
cf-polished: origFmt=png, origSize=10949
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="logo-tagline.webp"
content-length: 5302
cf-bgj: imgq:85,h2pri
last-modified: Thu, 30 Nov 2023 07:00:05 GMT
server: cloudflare
x-vcache: HIT
etag: "656832f5-2ac5"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e488ff0990904c-FRA
expires: Fri, 29 Nov 2024 07:05:40 GMT

GET
H2 200 syd-logo.png
bloximages.chicago2.vip.townnews.com/central.leetemplates.com/content/tncms/live/global/resources/images/blocks/deal-widget/ 3 KB
3 KB 122ms
116ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.chicago2.vip.townnews.com/central.leetemplates.com/content/tncms/live/global/resources/images/blocks/deal-widget/syd-logo.png?_dc=23.11.30.11

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45782508a28c1f03ebbfd53a3f172c85e77877a18b612b6dd23819cdc35dc54f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=5232
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="syd-logo.webp"
content-length: 2988
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Sep 2020 18:46:10 GMT
server: cloudflare
x-vcache: HIT
etag: "5f7380f2-1470"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489000aff9bf5-FRA
expires: Fri, 29 Nov 2024 16:00:23 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/leeenterprises/ 48 KB
19 KB 74ms
14ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/op.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d6ed3999a36ff91e0a758d067567be5a0ea2a15205257bab695728485e83e488

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: Dw33NwYwmWaVlj4tZuSeYIKERKq_faRb
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
date: Thu, 30 Nov 2023 15:45:43 GMT
x-amz-cf-pop: AMS1-P1
age: 3353
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19082
x-amz-meta-git_commit: e09f10f
last-modified: Thu, 30 Nov 2023 14:25:34 GMT
server: AmazonS3
etag: "4ff204294befb28512d92eeebd2cb85d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: _HVQVNRgTzvoPyLgWNgV-MHXEhOTBgcRGx0XP1cyFbDwd5VGYY81Wg==

GET
H2 200 heraldcourier.com.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/pb-config/ 1 KB
431 B 16ms
16ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/pb-config/heraldcourier.com.js?_dc=1696436850

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76460f1cd530a92dcb3d35468233b10d40dcb0ea7595aceb225104e63c3b78bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1855472
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:30 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9272-5b9"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488ff39b9904c-FRA
expires: Thu, 03 Oct 2024 16:32:56 GMT

GET
H2 200 dfp.lazy.pbjs.js Show response
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/ 17 KB
4 KB 17ms
17ms Script
application/x-javascript 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/dfp.lazy.pbjs.js?_dc=1696436849

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9453c81287d37b52d6364987b4fe7618de7f9761f3d6805432132efa7d5d2c60

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
content-encoding: br
cf-cache-status: HIT
age: 1941030
cross-origin-resource-policy: cross-origin
last-modified: Wed, 04 Oct 2023 16:27:29 GMT
x-vcache: MISS
server: cloudflare
etag: W/"651d9271-4477"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e488ff59d6904c-FRA
expires: Thu, 03 Oct 2024 16:32:57 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 230 KB
78 KB 52ms
18ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0ebf99d19e2297df9e5271ff4a224f78a15b460a11d62e022917f85cdca5beae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79082
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 30 Nov 2023 16:40:57 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 92 KB
30 KB 120ms
88ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a25dae516a0e3d73697c143d2c3fe12bc67e2e088e2dfddf9a95bcb9d108667a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30219
x-xss-protection: 0
server: cafe
etag: 300 / 19691 / 31079856 / config-hash: 15537148871505510223
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 30 Nov 2023 16:40:57 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 30ms
10ms XHR
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
date: Thu, 30 Nov 2023 12:09:55 GMT
x-amz-cf-pop: FRA56-P6
age: 16263
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: LiT453OK2HIIR9hqeLIUxpMfYq88Kga9RwXkzxvZg0sEIdv6DWEePg==

GET
H2 200 3266 Show response
config.aps.amazon-adsystem.com/configs/ 505 B
780 B 81ms
48ms Script
application/javascript 99.86.4.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/3266
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-128.fra6.r.cloudfront.net
Software: CloudFront /
Resource Hash: 4b9d00cdddea53b43ce092a8545d5527689379561d18d6f925355562ab2f359e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:06:26 GMT
via: 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
age: 2071
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 505
x-amz-cf-id: Zyy4iSytGNekZywG7ELhc9V7b1SMJDGv7m_V8GD3tTaFZe2R4A5_nQ==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
3 KB 13ms
13ms XHR
application/json 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3266&u=https%3A%2F%2Fheraldcourier.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: Server /
Resource Hash: cab29d30666c18a6b431d25c7d278a299bdb3d7b87c81400a813beb3b5d286e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 13:55:17 GMT
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
age: 9940
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 2334
x-amz-cf-id: Ke3FVqs1AZvZT5P6mxsx9Vc7Wcfa3fe-AEGw-vOfVG8-SR2XqXD5tA==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 85ms
11ms Script
application/javascript 23.57.19.78
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.19.78 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-19-78.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Thu, 30 Nov 2023 16:55:57 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 39 KB
12 KB 51ms
8ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 06:08:51 GMT
content-encoding: gzip
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 37927
x-amz-server-side-encryption: AES256
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 1TxEaCrYrfVY9WJWMgVJ878HowrfJii5sqhTo6_Y3ZiYKKlFT6Rnpw==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 69ms
31ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fheraldcourier.com%2F&ref=&_it=amazon&partner_id=663
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 15:31:45 GMT
server: cloudflare
x-amz-request-id: 01C975WVAA3JDKHJ
age: 4137
etag: W/"13043c1bbaf21ccc6e8ed474a744d3f2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 82e489004c475caa-FRA
x-amz-id-2: hxb2Br8vf2uBBniSeqakgjztWKIPtATtD6bN1gV+n3Vg6mNMl2rDRQL+gF8pDyHWIII6UuGjSsI=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 151 KB
33 KB 66ms
38ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7571db16348512fc55b35102ce3699733cf0882f4b4fb3e652fa8db700c07fb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Nov 2023 11:19:25 GMT
server: cloudflare
x-amz-request-id: MZ1SMZNNQ03R32VH
age: 81
etag: W/"53159e4ae3ffbda2ff6c0204350035be"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 82e489003c89bbbc-FRA
x-amz-id-2: PTtuGVlW86/lw6DBxeOyPXzoTsgfLjDUnYK3grbWOmKV5vopn3rRgL9PbvYp5z6ECilDUFmMBNY=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
129 B 93ms
93ms XHR
text/plain 54.82.88.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.88.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-88-241.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 30 Nov 2023 16:40:57 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 290ms
96ms Preflight 54.82.88.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.88.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-88-241.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heraldcourier.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Thu, 30 Nov 2023 16:40:57 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 tracker.gif
heraldcourier.com/shared-content/art/stats/common/ 0
145 B 88ms
88ms Image
image/gif 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heraldcourier.com/shared-content/art/stats/common/tracker.gif?tnms_rs=1600x1200x24&tnms_vtum=1&tnms_vt=1&tnms_vid=170136245760816001200875415301646&tnms_dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&tnms_upage=1&tnms_do=heraldcourier.com&tnms_uri=/&tnms_ref=&rt=1701362457610
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
last-modified: Thu, 16 Oct 2008 20:11:25 GMT
x-vcache: MISS
age: 0
etag: "48f79fed-0"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 545 KB
135 KB 125ms
104ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

afe650a677c77efbe244a6c5e688fa243c81e32325e2ded497986b90c8105b2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138134
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 30 Nov 2023 16:40:57 GMT

GET
DATA 200
OK truncated
/ 75 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 serif-ds.woff2
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/ 26 KB
26 KB 67ms
42ms Font
application/font-woff2 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/images/serif-ds.woff2

Requested by

Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701327605

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f98e8196d88bff2a006872a05d79c2d695f6dda36e0aecdd0ace020207809f40

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/lee_ds_v3/resources/styles/lee.ds.css?_dc=1701327605
Origin: https://heraldcourier.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
age: 1346921
cross-origin-resource-policy: cross-origin
content-length: 26164
last-modified: Tue, 31 Oct 2023 06:00:06 GMT
x-vcache: MISS
server: cloudflare
etag: "654097e6-6634"
vary: Accept-Encoding
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489005ca69baa-FRA
expires: Wed, 30 Oct 2024 13:40:16 GMT

GET
H2 200 656792cf6a682.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/27/a27a0444-8eee-11ee-9263-13da294b481a/ 10 KB
11 KB 120ms
118ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/27/a27a0444-8eee-11ee-9263-13da294b481a/656792cf6a682.image.jpg?crop=1175%2C661%2C0%2C551&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

772cc7306c10ad8e57e2303315aa784c2a10b4eec8b3c4f84cfcb0b3859699b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=14594
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656792cf6a682.webp"
content-length: 10714
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 19:36:50 GMT
server: cloudflare
x-vcache: MISS
etag: "aecc6f8c12287a7fb20a7320214ce1ba"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010be9904c-FRA
expires: Fri, 29 Nov 2024 11:42:46 GMT

GET
H2 200 609b5157bf11c.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/17/a170ad20-b2d5-11eb-bfd5-6b3c994a1a0e/ 7 KB
8 KB 113ms
111ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/17/a170ad20-b2d5-11eb-bfd5-6b3c994a1a0e/609b5157bf11c.image.jpg?crop=400%2C225%2C0%2C87&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

264b5d8b72d86e7fff1d7bb6b78ea34d60ae3d95d3188956c99def00d2bfaa5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=9729
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="609b5157bf11c.webp"
content-length: 7470
cf-bgj: imgq:85,h2pri
last-modified: Wed, 12 May 2021 03:54:02 GMT
server: cloudflare
x-vcache: MISS
etag: "c72171f147aeb3e25c66bfbab1395445"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010bed904c-FRA
expires: Thu, 28 Nov 2024 14:34:37 GMT

GET
H2 200 58425c9dd475f.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6e/06ed3456-b91c-11e6-80d1-97c20bc535b1/ 8 KB
8 KB 117ms
116ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6e/06ed3456-b91c-11e6-80d1-97c20bc535b1/58425c9dd475f.image.jpg?crop=400%2C225%2C0%2C87&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83190dc55cd275fc551670c9401e931e2ac13cbf067c4d6656f7ba0cf9d51c9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=10227
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="58425c9dd475f.webp"
content-length: 8438
cf-bgj: imgq:85,h2pri
last-modified: Sat, 03 Dec 2016 05:48:16 GMT
server: cloudflare
x-vcache: MISS
etag: "4b7cca22c50a52a5623b68dc5a628e23"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010bee904c-FRA
expires: Fri, 29 Nov 2024 08:29:15 GMT

GET
H2 200 6568899fdd760.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/9/75/975cbdbf-51c9-5646-9ec8-d9c3bbc33d66/ 10 KB
10 KB 121ms
120ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/9/75/975cbdbf-51c9-5646-9ec8-d9c3bbc33d66/6568899fdd760.preview.jpg?crop=636%2C358%2C0%2C32&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15b9c35d100fe81ed916760c37d124dec8b0a81d6cd737b0020652b6d5015e15

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=11888
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="6568899fdd760.webp"
content-length: 10428
cf-bgj: imgq:85,h2pri
last-modified: Thu, 30 Nov 2023 13:09:53 GMT
server: cloudflare
x-vcache: HIT
etag: "b50030dec060627051ef79f26e8c0fde"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010bf4904c-FRA
expires: Fri, 29 Nov 2024 14:05:39 GMT

GET
H2 200 656791581706c.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/b/ca/bca6395a-94d5-52de-bf32-1d4c9e96b04d/ 9 KB
9 KB 121ms
121ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/b/ca/bca6395a-94d5-52de-bf32-1d4c9e96b04d/656791581706c.preview.jpg?crop=898%2C505%2C11%2C0&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

188b3c1d052fc9ee9abfde7e1ef2535cd46bfc2059c36af092b9b15753d7449d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=9610
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656791581706c.webp"
content-length: 9064
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 19:30:34 GMT
server: cloudflare
x-vcache: MISS
etag: "527245f4b78216d4f37b895903363315"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010bf6904c-FRA
expires: Fri, 29 Nov 2024 08:26:40 GMT

GET
H2 200 5d0b85013e5f4.image.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/f/42/f424f698-80dd-11ed-9fbb-9be33b07309e/ 4 KB
4 KB 386ms
385ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/f/42/f424f698-80dd-11ed-9fbb-9be33b07309e/5d0b85013e5f4.image.png?crop=475%2C267%2C0%2C103&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d5575dee7e4b9fe4369c3f7de0e25337d15e0d0f045eaf41556e7eb35fcdb63

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=8255
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="5d0b85013e5f4.webp"
content-length: 4158
cf-bgj: imgq:85,h2pri
last-modified: Wed, 21 Dec 2022 03:17:09 GMT
server: cloudflare
x-vcache: MISS
etag: "2cd8370cb4b642dc411b26e44514ce4b"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e489010bf7904c-FRA
expires: Fri, 29 Nov 2024 12:38:25 GMT

GET
H2 200 65678aa9e0a8b.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/6/25/6254dfa3-401d-5db0-b9b6-eb127a3458b8/ 15 KB
15 KB 138ms
138ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/6/25/6254dfa3-401d-5db0-b9b6-eb127a3458b8/65678aa9e0a8b.preview.jpg?crop=1763%2C992%2C0%2C91&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73728b044c01556d3957c4c1bcd704f74e28707d80e593490e5bc76bf4619ea2

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=15895, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 19:02:03 GMT
server: cloudflare
x-vcache: MISS
etag: "5570e8c4dabe675281396f828b4e3376"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e489010bf8904c-FRA
expires: Thu, 28 Nov 2024 19:09:42 GMT

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ 84 KB
31 KB 17ms
16ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3569419
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Q_h5kH6V-V4SvXi3rQKk_fxijFmVKJ1pdzlB77T2bcU5Ha4bkJATpQ==

GET
H2 200 bl-b80957a-b92de787.js Show response
tagan.adlightning.com/leeenterprises/ 87 KB
37 KB 21ms
21ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/bl-b80957a-b92de787.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e3fddc66d879f16be5d2a391945eeeba4ffce21cc3d7b6547019061751aec25

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 14:44:45 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: uaLeMvfFnfZSurWutJML3xzTOfsl05A_
x-amz-cf-pop: AMS1-P1
age: 6973
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 36894
x-amz-meta-git_commit: b80957a
last-modified: Thu, 30 Nov 2023 14:25:16 GMT
server: AmazonS3
etag: "644ccfed2c12b925c34b13b7a442343b"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: _dhLkCI8FZzHgX4E4hQtNokLT2sSDPka-qN4wUGYEoqnCu-b1gCr1w==

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 102 B
291 B 109ms
108ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=663&sync=0&domain=heraldcourier.com&url=https://heraldcourier.com/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fheraldcourier.com%2F&ref=&_it=amazon&partner_id=663
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e208efd3bc7196c5db30d0bf795cfb8513849fded1049006dce387cb818ebfc9

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 82e48902df5d2bec-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 169ms
119ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=663&sync=0&domain=heraldcourier.com&url=https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://heraldcourier.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 82e489021e312bec-FRA
content-length: 0
content-type: application/json
date: Thu, 30 Nov 2023 16:40:58 GMT
debug: OPTIONS block
expires: Fri, 29 Nov 2024 16:40:57 GMT
server: cloudflare

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 40ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 30 Nov 2023 15:49:38 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3079
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 30 Nov 2023 17:49:38 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 179 KB
63 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5MTD44X&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6cbf86ba207b9b7808110776768d951b4faa4ee245fb03264b95978e10e96a10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64826
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 30 Nov 2023 16:40:57 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 217 KB
69 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WXMV2VZ&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PDQV3N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9fd343a79407da4497fb0204a7d55f36d943d8848dbb34c737190db294bb7b85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70432
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 30 Nov 2023 16:40:57 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/ 432 KB
135 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e071e5b39d13cef80f7a46d854de133fd73c15d1351ebcf7e1f1b48821e7aeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 11:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18290
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138259
x-xss-protection: 0
server: cafe
etag: 16445146976575771301
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 29 Nov 2024 11:36:07 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 124ms
35ms XHR
application/json 34.255.67.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.67.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-67-121.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 13c3d75c44519f376598514c25b7bc0d5c7a0a913f099325baad6dadaeec7d69

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache
x-server: 10.45.0.74
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/ Frame 9AA9
Redirect Chain

https://insight.adsrvr.org/tags/nebsjkp/21usqg2/iframe
https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

138 B
668 B

61ms
13ms

Document
text/html

18.238.17.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.17.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-17-128.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3f7d4fce911e0a58ed4224b9f65d90a98d8bb7b76d25ad2610485b9baaa1d447

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 63280
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 138
Content-Type: text/html
Date: Wed, 29 Nov 2023 23:06:19 GMT
ETag: "50351b1f6590b5c4886c111874e016a0"
Last-Modified: Fri, 01 Oct 2021 23:50:10 GMT
Server: AmazonS3
Via: 1.1 e3d9ae12f22103dbc65c451ae520a012.cloudfront.net (CloudFront)
X-Amz-Cf-Id: nJpfymADmRfxE4-4mVPT3WpoK5n_m3JGfiYH8ohNlUdRsLWVrPg86Q==
X-Amz-Cf-Pop: AMS58-P1
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 0
date: Thu, 30 Nov 2023 16:40:58 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 68ms
12ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 30 Nov 2023 16:40:58 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: qDJTEj5fk6ZVMbRC+LEKSS6LBwMjqk7uguxO24YOQeu0SlGrRF4lP20jKOMW6nJNhswBuiW7AUMa0CgIJsaoaQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 5b5dc540-ca6c-013a-51e3-0cc47a8ffaac Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 327ms
16ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/5b5dc540-ca6c-013a-51e3-0cc47a8ffaac
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 57f295553fdda2a7f1ee0e5dab92d82f2bace1df0a781117dee1cb06eacbf891

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
x-request-id: F5x0JEg5sh6fTWgOyMvB
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dd6a943e7ae98e23609590112a987c50e2ca6a3b4c32a32039d7c5327759d990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90347
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 30 Nov 2023 16:40:58 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 30 Nov 2023 15:49:38 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3080
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 30 Nov 2023 17:49:38 GMT

GET
H2 200 p.js Show response
cdn.parsely.com/keys/heraldcourier.com/ 57 KB
21 KB 75ms
16ms Script
application/javascript 13.227.217.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/heraldcourier.com/p.js?gtm_ver=3.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.217.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-217-72.ams54.r.cloudfront.net
Software: nginx /
Resource Hash: 4c0867ff49805574426a7a89e712807767fa9b2452c526736947e2b897a080ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: public
date: Thu, 30 Nov 2023 13:35:42 GMT
content-encoding: gzip
via: 1.1 2b298af2bb6f21ab0dee9e764d8bcb28.cloudfront.net (CloudFront)
last-modified: Mon, 09 Oct 2023 15:21:06 GMT
server: nginx
x-amz-cf-pop: AMS54-C1
age: 11116
etag: W/"65241a62-e28b"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400, public
x-amz-cf-id: qsadbWsQbjYo0WZyOhQt_-Q0a_Vna9YESqPTrOZPrE5ZK06zvEd4wg==
expires: Fri, 01 Dec 2023 13:35:42 GMT

GET
H2 200 a-058n.min.js Show response
b-code.liadm.com/ 47 KB
15 KB 93ms
21ms Script
application/javascript 2600:9000:2090:400:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-058n.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDWDC2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2090:400:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a2abf60298591077c6d5b81d97380295dd942ef36095adf4de1ee06f90077545

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:23:18 GMT
content-encoding: gzip
via: 1.1 1fb7ef67aaeb45ceb86b21babb0ba848.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P1
age: 29860
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: jD2aQKfc6tF2LLkJ_YMk_TlnSi-syhYCqrXnvoOvWj_XTeFGBuFkvQ==

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma1527/lee/5/
Redirect Chain

https://js.matheranalytics.com/s/ma1527/725149306/lee/ml.js?cb=1641
https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js

145 KB
42 KB

13ms
11ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8e69c64655718315422d63e22bc7dddaacd2fe1e1ceb20a6758287a76b9c6f66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 08:09:12 GMT
content-encoding: br
via: 1.1 google
last-modified: Wed, 04 Aug 2021 03:52:13 GMT
server: nginx
age: 30706
etag: "96d23de5d1ede166c2abc188adf1ebd7"
vary: Accept-Encoding
x-cache: HIT Sun, 18 Dec 2022 05:54:02 GMT
content-type: application/x-javascript
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43093

Redirect headers

date: Thu, 30 Nov 2023 16:40:58 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma1527/lee/5/ml.br.js
cache-control: public, max-age=269200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-served-by: 1-gc-europe-west6-8j341039

GET
H2 200 663 Show response
a.ad.gt/api/v1/u/matches/ 12 KB
4 KB 398ms
355ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/663?_it=amazon
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3412bd2510a0f987cafbe82fed002c0c0cadfc6d66ce0a594eaa62bad4a60714

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Thu, 30 Nov 2023 16:03:23 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 82e4890488e99b1f-FRA

GET
H3 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
722 B 7ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 Nov 2023 17:34:06 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
441 B 40ms
15ms XHR
application/json 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94
x-xss-protection: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
504 B 115ms
58ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3266&u=https%3A%2F%2Fheraldcourier.com%2F&pid=KtmvVCT1kvXWi&cb=0&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22breakout_top%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F8438%2Fheraldcourier.com%2Fhomepage%22%7D%5D&pj=%7B%22sections%22%3A%22%22%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-119-77.fra60.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: YW4FJ7V8AJEC5TM7XDBJ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: iE7qoV0LNn6qBAnnHFL8PFtpKNV2eJRlmArpcLaVT6lR-MW6c28_TA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
506 B 96ms
47ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3266&u=https%3A%2F%2Fheraldcourier.com%2F&pid=KtmvVCT1kvXWi&cb=1&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22breakout_middle%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F8438%2Fheraldcourier.com%2Fhomepage%22%7D%5D&pj=%7B%22sections%22%3A%22%22%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-119-77.fra60.r.cloudfront.net

Software

Server /

Resource Hash

8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: C44AM2GQQ7Q7FE6TF8PA
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: TciUGaBkNWE2CLoBIfcZA-68vMXq1Q9NoX-r2L7DFwBE6_LeNU1gaA==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
33 KB 20ms
19ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Nov 2023 11:19:25 GMT
server: cloudflare
x-amz-request-id: 53GGBM5A6XBRJD2W
age: 3346
etag: W/"d12fc51ceb66081fc72dabad6e4e0ded"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 82e489052aaebbbc-FRA
x-amz-id-2: +r3IAnmtspceOaG1P4pbsdXEsJtBBACfmiF8uWKvw4Pf0lwmAmf71J80yWQcWt5hYVJvZ/iixAE=

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 44ms
17ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6936
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230065-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g9i1Xfss5gvL6%2B5ZO8KODDxx5JH%2Ft%2FbZ7YJjXh%2FwJ3OFiOzudwtYKkcH17pCbKNGoxDKlb5ICeBMnsudNKi2cC8f3SDg%2F%2FZcNlmjjdcco6CDsVRCUncfVA1oVg9YeI%2FKRBtoM9xeZeVkdawjccE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 82e489054c1765cf-FRA

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 40ms
11ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 14:29:33 GMT
content-encoding: gzip
age: 612685
x-guploader-uploadid: ADPycdsxLlKLCVb5W3Djj1V0MEZiayMLPqEhV9H3fgXZaELS3ccW0PQo2-GKz1rWI_UNhL9w3-cScigVqDHesSZuOcxycA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Fri, 22 Nov 2024 14:29:33 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 63ms
18ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:40:58 GMT

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 72ms
7ms Script
text/javascript 2600:9000:2250:7400:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:7400:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Thu, 30 Nov 2023 10:03:28 GMT
Via: 1.1 03249875678629095a5ec311a6f1a298.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 23851
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: U5GAukaTpCuIKMUrx-QRFW1iXZaACMT8Oq1zTqPXGR0OABUN9VpIQA==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 95ms
31ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 6445981558b1dbcb1b9637e65c171bcf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 9ms
9ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 07:38:20 GMT
content-encoding: gzip
via: 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 32559
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: hTk7o2cv-bkXHmXpYlafWj2KICAQHZWvzdh2vzdJlRouQY-3KkOiBw==

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 124ms
19ms Script
application/javascript 2600:9000:2090:d000:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2090:d000:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:30:08 GMT
via: 1.1 551a3a9c2bf1e2158a9f24897afe2b8c.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: AMS58-P1
age: 651
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: Xt0zFQ2bkUCAThMMWlbURssxMfFaJzyFcPRosL_LhqSXC95C60ceRw==

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
16 KB 81ms
81ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=3909189045263606&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=2x1&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701362458386&lmt=1701360325&adxs=799&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEhkKCnB1YmNpZC5vcmcYjr7riMIxSABSAghkEhgKCXlhaG9vLmNvbRiOvuuIwjFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Yjr7riMIxSABSAghkEhcKCHJ0YmhvdXNlGI6-64jCMUgAUgIIZBIUCgVvcGVueBiOvuuIwjFIAFICCGQSGQoKdWlkYXBpLmNvbRiOvuuIwjFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGI2-64jCMUgAUgIIZA..&dlt=1701362457275&idt=1034&prev_scp=pos%3Dfixed-impact-top%2Catf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D2%26lee_hours%3D16%26lee_day%3D4&cust_params=amznbid%3D0%26amznp%3D0%26k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=744025060&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ed99a17599d95ef5b866d328c1e0e501bc0e38f24d334f6b942b20b47565380

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16484
x-xss-protection: 0
google-lineitem-id: 6411102447
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138453862257
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 560 B
290 B 52ms
51ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=3948149333432724&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701362458400&lmt=1701360325&adxs=800&adys=1&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEhkKCnB1YmNpZC5vcmcYjr7riMIxSABSAghkEhgKCXlhaG9vLmNvbRiOvuuIwjFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Yjr7riMIxSABSAghkEhcKCHJ0YmhvdXNlGI6-64jCMUgAUgIIZBIUCgVvcGVueBiOvuuIwjFIAFICCGQSGQoKdWlkYXBpLmNvbRiOvuuIwjFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGI2-64jCMUgAUgIIZA..&dlt=1701362457275&idt=1034&prev_scp=pos%3Dfixed-impact-bottom%2Cbtf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D5%26lee_hours%3D16%26lee_day%3D4&cust_params=amznbid%3D0%26amznp%3D0%26k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=626189969&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4269539026c67a7e14f5d6ae39aa2fbfba7a17ab17b1cf2a95b4cf0ef7a1e59a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 182ms
181ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=599019442653970&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=3x1&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701362458405&lmt=1701360325&adxs=1155&adys=1054&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=325x1&msz=325x1&fws=4&ohw=1600&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEhkKCnB1YmNpZC5vcmcYjr7riMIxSABSAghkEhgKCXlhaG9vLmNvbRiOvuuIwjFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Yjr7riMIxSABSAghkEhcKCHJ0YmhvdXNlGI6-64jCMUgAUgIIZBIUCgVvcGVueBiOvuuIwjFIAFICCGQSGQoKdWlkYXBpLmNvbRiOvuuIwjFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGI2-64jCMUgAUgIIZA..&dlt=1701362457275&idt=1034&prev_scp=pos%3Dnative_ad_grid_v3%2Catf%2C50%26density%3Dstandard%26lee_group%3D9%26lee_hours%3D16%26lee_day%3D4&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=3133586711&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e75ec9da1ddef1adb9dcebaf0df2ebeb0dd88c924bc051d4e555f7e32fab3c17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13079
x-xss-protection: 0
google-lineitem-id: 6059470473
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138397768800
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 560 B
294 B 53ms
52ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=2695348151978975&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=7x1&ifi=4&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701362458409&lmt=1701360325&adxs=120&adys=1740&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1360x1&msz=1360x1&fws=4&ohw=1600&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEhkKCnB1YmNpZC5vcmcYjr7riMIxSABSAghkEhgKCXlhaG9vLmNvbRiOvuuIwjFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Yjr7riMIxSABSAghkEhcKCHJ0YmhvdXNlGI6-64jCMUgAUgIIZBIUCgVvcGVueBiOvuuIwjFIAFICCGQSGQoKdWlkYXBpLmNvbRiOvuuIwjFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGI2-64jCMUgAUgIIZA..&dlt=1701362457275&idt=1034&prev_scp=pos%3Dsponsor-banner-impact%2Cbtf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D4%26lee_hours%3D16%26lee_day%3D4&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=1077773998&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0cb861cd799b7c0271ff8b227ca1f54d8e0e096558573386ca3e9e70f31c1bd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 264
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 567 B
302 B 50ms
49ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=805160959691314&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=5x1&ifi=5&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701362458415&lmt=1701360325&adxs=798&adys=6475&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x1&msz=1600x1&fws=4&ohw=1600&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEhkKCnB1YmNpZC5vcmcYjr7riMIxSABSAghkEhgKCXlhaG9vLmNvbRiOvuuIwjFIAFICCGQSHQoOZXNwLmNyaXRlby5jb20Yjr7riMIxSABSAghkEhcKCHJ0YmhvdXNlGI6-64jCMUgAUgIIZBIUCgVvcGVueBiOvuuIwjFIAFICCGQSGQoKdWlkYXBpLmNvbRiOvuuIwjFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGI2-64jCMUgAUgIIZA..&dlt=1701362457275&idt=1034&prev_scp=pos%3Dmembers-impact%2Catf%26inview%3Dtrue%26density%3Dstandard%26lee_group%3D1%26lee_hours%3D16%26lee_day%3D4&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=2681755583&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f7c228db76f66cd6b7657b99fb3a177d40b1ffd1cc3aa3013f746a55fae0993

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 272
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F12E 6 KB
3 KB 88ms
16ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 16:40:58 GMT
expires: Fri, 29 Nov 2024 16:40:58 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
insight.adsrvr.org/track/pxl/ Frame 9AA9 70 B
149 B 34ms
34ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=nebsjkp&ct=0:21usqg2&fmt=3
Requested by: Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/nebsjkp/21usqg2/iframe
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 6568acb4210bb.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/e/a6/ea6f0e35-2471-5568-b0c9-e499a4827d03/ 20 KB
21 KB 129ms
124ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/e/a6/ea6f0e35-2471-5568-b0c9-e499a4827d03/6568acb4210bb.preview.jpg?crop=1749%2C984%2C0%2C100&resize=750%2C422&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb741d04c2e816bab14a490a49da34c71acabb019410e0e07de44aa8ba64996a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=25518
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="6568acb4210bb.webp"
cf-bgj: imgq:85,h2pri
last-modified: Thu, 30 Nov 2023 15:39:38 GMT
server: cloudflare
x-vcache: MISS
etag: "843c9e4f8b5e178eac2f0db7fb04a274"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e4890578d7904c-FRA
expires: Fri, 29 Nov 2024 16:01:27 GMT

GET
H2 200 656886f0034af.preview.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/7/74/7740b47f-9b36-53f2-9bea-f6c95455d858/ 42 KB
42 KB 141ms
136ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/7/74/7740b47f-9b36-53f2-9bea-f6c95455d858/656886f0034af.preview.png?crop=624%2C351%2C314%2C74&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96a87724858479a0639f7ffb5b65d0a080eb5cc66fec21e0d7d45201902fce79

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=66535
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656886f0034af.webp"
cf-bgj: imgq:85,h2pri
last-modified: Thu, 30 Nov 2023 12:58:29 GMT
server: cloudflare
x-vcache: MISS
etag: "81e3dec3b9839433fe09658109b4a9c6"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e4890578d8904c-FRA
expires: Fri, 29 Nov 2024 13:36:21 GMT

GET
H2 200 6567f0c856be4.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/57/a57f84ec-8f26-11ee-904d-bf0b9e129a7b/ 14 KB
14 KB 124ms
119ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/57/a57f84ec-8f26-11ee-904d-bf0b9e129a7b/6567f0c856be4.image.jpg?crop=1763%2C992%2C0%2C91&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a04d3aa7560e4ce461a5f68a1fcd23cc5dbecb0aa06f1fefaa7c65e156a8197

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: degrade=85, origSize=15690, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 13824
cf-bgj: imgq:85,h2pri
last-modified: Thu, 30 Nov 2023 02:17:49 GMT
server: cloudflare
x-vcache: MISS
etag: "643a30a6fac12140962df8b6405375d7"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e4890578da904c-FRA
expires: Fri, 29 Nov 2024 03:24:22 GMT

GET
H2 200 65670377e858e.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/5/d7/5d7fa2ac-ab09-5283-89fc-cf2fcde6c26e/ 9 KB
9 KB 117ms
113ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/5/d7/5d7fa2ac-ab09-5283-89fc-cf2fcde6c26e/65670377e858e.image.jpg?crop=1763%2C992%2C0%2C92&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

532c6209f79961f1dc5b3d368d218cd2cd1c82f059b2c79bf1b4ab5e79ed4b92

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=9554, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 09:25:12 GMT
server: cloudflare
x-vcache: MISS
etag: "eb898250454b1abead00d2cc2e7ba196"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e4890578dd904c-FRA
expires: Thu, 28 Nov 2024 19:00:53 GMT

GET
H2 200 656792cf6a682.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/27/a27a0444-8eee-11ee-9263-13da294b481a/ 7 KB
7 KB 127ms
122ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dbe47d0e8f6fb7905ae043b478f8d242c5ae631e9bb1ad8d0299bf35bd7e331

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=10577
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="656792cf6a682.webp"
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 19:36:50 GMT
server: cloudflare
x-vcache: MISS
etag: "bea071bbf0c301f85d3f485ae5a61019"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e4890588df904c-FRA
expires: Fri, 29 Nov 2024 06:56:36 GMT

GET
H2 200 65678ee62875c.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/12/d1229b5b-a6b6-595c-8a71-9c614e33acf6/ 14 KB
14 KB 115ms
111ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/12/d1229b5b-a6b6-595c-8a71-9c614e33acf6/65678ee62875c.image.jpg?crop=1763%2C992%2C0%2C91&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aebcff89e622223af0c9eb0c090d0914bb4ade8d93ad16873ac3f0ba4a6ef134

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: degrade=85, origSize=16564, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 19:20:07 GMT
server: cloudflare
x-vcache: MISS
etag: "3c115c2c059bc487318449f098a9f144"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e4890588e0904c-FRA
expires: Fri, 29 Nov 2024 00:33:43 GMT

GET
H2 200 6567bd56f35db.preview.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/fc/dfc890ef-3020-5e77-b074-6f2148177825/ 13 KB
13 KB 116ms
112ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/fc/dfc890ef-3020-5e77-b074-6f2148177825/6567bd56f35db.preview.jpg?crop=917%2C516%2C0%2C0&resize=300%2C169&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7bd716b2e392ee5cb7d08e74045b0b7505c3f1a3fb0594e0410671a33e36657

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=13034, status=webp_bigger
cross-origin-resource-policy: cross-origin
content-length: 12950
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Nov 2023 22:38:16 GMT
server: cloudflare
x-vcache: MISS
etag: "5eef00c9582f4117f8a6c92098123c13"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e4890588e1904c-FRA
expires: Fri, 29 Nov 2024 12:41:58 GMT

POST
H2 200 auction Show response
bidder.newspassid.com/openrtb2/ 133 B
769 B 394ms
162ms XHR
application/json 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/openrtb2/auction
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 41178cf09bd0bd00132c58f2597f8d249d92fbeab38bcbbdc5c8e0b7f810a3fd

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 133
expires: 0

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 107 KB
29 KB 74ms
9ms Script
text/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1186699d4cc78d7acd98f87883b1434fa96f46c29aafba60659b1f97814fd3d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: hsqC1M3zTyLz6Qc8AwMehTiEPIw.GNBf
content-encoding: br
via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
date: Thu, 30 Nov 2023 16:40:15 GMT
x-amz-cf-pop: FRA6-C1
age: 44
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 16 Nov 2023 19:51:47 GMT
server: AmazonS3
etag: W/"dbada6b699a28dea7a0791c760c06cca"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=120
vary: Accept-Encoding
x-amz-cf-id: vAgw68mTRMTARJX47rpiBt71qKxk1sAeL2J_53Btnp3Py8Tcjww2bw==

POST
H2 200 auction Show response
bidder.newspassid.com/openrtb2/ 133 B
765 B 342ms
147ms XHR
application/json 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/openrtb2/auction
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 27dcbcdf1f083c39f9a1e995559b5ee5b2c3bb4574dd87c09e7024175ebea1b3

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
vary: Origin
content-type: application/json
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 133
expires: 0

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
370 B 45ms
15ms XHR
application/json 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 961211893969940 Show response
connect.facebook.net/signals/config/ 144 KB
37 KB 192ms
191ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/961211893969940?v=2.9.138&r=stable&domain=heraldcourier.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2fab007bf0e62a9458be4c17ddc938c6ca5e2338a7ff316652a42e69104175f7

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 30 Nov 2023 16:40:58 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: OkoTdEN6YZQrAahnBrsBBRH+psIEQ/TJDK1wd+aa4hgaJkdRBnKtNWIq5pYhpgetbQIskQwrTnpTjZlVqSVMAw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 255 KB
87 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d3947f2cdf1945e39038ab0490fe6752575d6e92c4a9facee108ddad21b00785

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88791
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 30 Nov 2023 16:40:58 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
247 B 40ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S5LKEZJN96&gtm=45je3b60v893785645z86749731&_p=1701362457537&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1723897376.1701362458&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701362458&sct=1&seg=0&dl=https%3A%2F%2Fheraldcourier.com%2F&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&en=page_view&_fv=1&_ss=1&ep.domain=heraldcourier.com&ep.asset_flag_array=false&ep.asset_tag_array=false&ep.page_type=homepage&ep.platform=desktop&ep.application=editorial&ep.byline=Undefined&ep.syndication_domain=null&ep.blox_sections=&ep.url_fragment=&ep.author=Undefined&ep.eedition_view_type=Page%20View&ep.asset_app=editorial&ep.asset_has_paywall=notset&ep.asset_has_video=no&up.user_status=anonymous&up.user_subscription=No&up.user_ppid=&up.user_uuid=false&up.user_subscription_date=false&tfd=2303
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 83ms
19ms Ping
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S5LKEZJN96&cid=1723897376.1701362458&gtm=45je3b60v893785645z86749731&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
409 B 72ms
48ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S5LKEZJN96&cid=1723897376.1701362458&gtm=45je3b60v893785645z86749731&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=775585459

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
p1.parsely.com/px/ 43 B
229 B 165ms
29ms Image
image/gif 52.17.99.225
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/px/?rand=1701362458658&plid=68648901-8263-494e-b00b-0a6bdf0944af&idsite=heraldcourier.com&url=https%3A%2F%2Fheraldcourier.com%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22user_subscription%22%3A%22No%22%7D&sid=1&surl=https%3A%2F%2Fheraldcourier.com%2F&sref=&sts=1701362458547&slts=0&title=Bristol+Herald+Courier+%7C+Breaking+News+%7C+%7C+Read+Bristol%2C+VA+and+Virginia+breaking+news.+Get+latest+news%2C+events+and+information+on+Virginia+sports%2C+weather%2C+entertainment+and+lifestyles&date=Thu+Nov+30+2023+17%3A40%3A58+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=d41eda0d-19a9-4d35-b9ad-77f9421c1d99&u=pid%3Dd359c2d6-3c27-4ecb-aee6-99018b1ff677
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.99.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-99-225.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Thu, 30 Nov 2023 16:40:58 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
233 B 65ms
8ms XHR
text/plain 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Thu, 30 Nov 2023 16:40:58 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame DFB6 84 KB
31 KB 20ms
19ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3569421
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: EQmlPhVMnydanRMOciAtiRZ--a1RSNGj3SgbNIAl6-FGfaDV9dGkRg==

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DFB6 202 KB
64 KB 174ms
142ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Nov 2023 16:40:59 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1

85 B
204 B

122ms
120ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 7b1a1dbd0f5fe7429be8f57f4f18a80d428a03fe89f822c01ef9d56d3dc085c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-Tza8GZlqVHj8w8vhAluHLWhCkZ0"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://heraldcourier.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Thu, 30 Nov 2023 16:40:59 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://heraldcourier.com
location: /esp?url=https%3A%2F%2Fheraldcourier.com%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 455ms
92ms Image
image/gif 54.175.178.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sec=homepage&pubname=The%20Bristol%20Herald%20Courier&ptype=homepage&metered=0%7C3&cms=townnews%2Fblox&arttype=editorial&tv=js-3.0.136&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-60&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=5&tvcfg=lee&tid=614b0be2-69ed-4a0b-9729-5e350a7345e3&pid=1b46d09e-cf50-45ef-80c8-8a74c418984b&dtm=1701362459075&qnm=_matherq&visible=1&tabid=39435ea3-6a14-4bfa-8036-15bcdbb7fb40&url=https%3A%2F%2Fheraldcourier.com%2F&vp=1600x1200&ds=1600x6496&tofa=1701362459&vid=1&lvidt=1701362459&duid=a31c5a8cf005d6b2&fp=2142261801&cid=ma1527&mrk=725149306&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTcwMTM2MjQ1NjM0NCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIzMy4xbWIiLCJoZWFwVCI6IjUwLjRtYiIsImZzdFBhaW50IjoiMTQzNiIsImZldGNoUyI6IjQwOSIsImRvbWFpblMiOiI1ODgiLCJkb21haW5FIjoiNTg4IiwiY29ublMiOiI1ODgiLCJjb25uRSI6Ijc1OSIsInNzbFMiOiI2NzIiLCJyZXF1UyI6Ijc1OSIsInJlc3BTIjoiOTI3IiwicmVzcEUiOiIxMDEyIiwiZG9tTG9hZCI6IjkzMSIsImRvbUludGVyIjoiMTYxNSIsImRvbUxvYWRTIjoiMTYxOSIsImRvbUxvYWRFIjoiMTYyMyJ9LCJrZXl3b3JkcyI6WyJicmVha2luZyBuZXdzIiwid2VhdGhlciIsImNyaW1lIiwicG9saXRpY3MiLCJlbnRlcnRhaW5tZW50IiwibGlmZXN0eWxlcyIsInNwb3J0cyJdLCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjE3MjM4OTczNzYiLCJyZWZUaW1lIjoiMTcwMTM2MjQ1OTA3NCJ9XX0
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.175.178.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-175-178-6.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 30 Nov 2023 16:40:59 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1701362459097&aid=a-058n&se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&tna=v2.11.1&pu=https%3A%2F%2Fheraldcourier.com%2F&ext__pubcid=65698af0-cc65-4662-8556-6cf...
https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&aid=a-058n&tna=v2.11.1&dtstmp=1701362459097&n3pc=true&wpn=lc-bundle&ext__pubcid=65698af0-cc65-4662-8556-6cffe80f7401&i6=...

50 B
355 B

339ms
96ms

XHR
application/json

3.227.126.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&aid=a-058n&tna=v2.11.1&dtstmp=1701362459097&n3pc=true&wpn=lc-bundle&ext__pubcid=65698af0-cc65-4662-8556-6cffe80f7401&i6=MmEwMTo0YTA6NWE6OjEw&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0yIj5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-QXVkaW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xMyI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE0Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTUiPkNvbGxlY3Rpb248L3RpdGxlPg
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Server: 3.227.126.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-126-241.compute-1.amazonaws.com
Software: /
Resource Hash: bf8a676a7f02c526c2946d58540257c34ef4a32ccd46787e08a031073b4ff642

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
x-pixel-event-id: 470ae9c1-0ca4-42a8-bff6-af8b840f8552
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 50

Redirect headers

location: https://rp4.liadm.com/j?se=e30&duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&aid=a-058n&tna=v2.11.1&dtstmp=1701362459097&n3pc=true&wpn=lc-bundle&ext__pubcid=65698af0-cc65-4662-8556-6cffe80f7401&i6=MmEwMTo0YTA6NWE6OjEw&pu=https%3A%2F%2Fheraldcourier.com%2F&c=PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IlJlYWQgdGhlIGxhdGVzdCBCcmlzdG9sLCBWQSBuZXdzLiBHZXQgdGhlIGxhdGVzdCBvbiBldmVudHMsIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCwgbGlmZXN0eWxlcyBhbmQgbW9yZS4iPjx0aXRsZT5CcmlzdG9sIEhlcmFsZCBDb3VyaWVyIHwgQnJlYWtpbmcgTmV3cyB8IHwgUmVhZCBCcmlzdG9sLCBWQSBhbmQgVmlyZ2luaWEgYnJlYWtpbmcgbmV3cy4gR2V0IGxhdGVzdCBuZXdzLCBldmVudHMgYW5kIGluZm9ybWF0aW9uIG9uIFZpcmdpbmlhIHNwb3J0cywgd2VhdGhlciwgZW50ZXJ0YWlubWVudCBhbmQgbGlmZXN0eWxlczwvdGl0bGU-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vaGVyYWxkY291cmllci5jb20vIj48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMSI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0yIj5WaWRlbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTMiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNCI-VmlkZW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS01Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTYiPkF1ZGlvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtNyI-QXVkaW88L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS04Ij5BdWRpbzwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTkiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTAiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTEiPlZpZGVvPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTIiPkNvbGxlY3Rpb248L3RpdGxlPjx0aXRsZSBpZD0idG50LXN2Zy10aXRsZS0xMyI-Q29sbGVjdGlvbjwvdGl0bGU-PHRpdGxlIGlkPSJ0bnQtc3ZnLXRpdGxlLTE0Ij5Db2xsZWN0aW9uPC90aXRsZT48dGl0bGUgaWQ9InRudC1zdmctdGl0bGUtMTUiPkNvbGxlY3Rpb248L3RpdGxlPg
access-control-allow-origin: https://heraldcourier.com
date: Thu, 30 Nov 2023 16:40:59 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 18ms
16ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1941353069&t=pageview&_s=1&dl=https%3A%2F%2Fheraldcourier.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgUAjAAQCACAAI~&jid=2072316261&gjid=1312805612&cid=1723897376.1701362458&tid=UA-54716522-7&_gid=931987926.1701362459&_slc=1&gtm=45He3b60n71PDQV3Nv72758733&cd2=editorial&cd3=flex&cd4=flex-editorial&cd5=no&cd6=Large%3A%20Desktop%20computers.&cd8=200&cd9=No&cd10=No&cd12=No&cd13=https%3A%2F%2Fheraldcourier.com%2F&cd16=No&cd17=Page%20View&cm1=1660&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=1897035636

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
149 B 22ms
18ms XHR
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-54716522-7&cid=1723897376.1701362458&jid=2072316261&gjid=1312805612&_gid=931987926.1701362459&_u=aCDAgUAjAAQCAGAAI~&z=1698164896

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 15ms
15ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1941353069&t=pageview&_s=1&dl=https%3A%2F%2Fheraldcourier.com%2F&ul=en-us&de=UTF-8&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAiUAjBAQCAGAEKAB~&jid=874783360&gjid=403341364&cid=1723897376.1701362458&tid=UA-54716522-2&_gid=931987926.1701362459&_slc=1&gtm=45He3b60n71TDWDC2v6749731&cd1=desktop&cd2=heraldcourier.com&cd3=editorial&cd4=homepage&cd6=homepage&cd14=Undefined&cd17=null&cd20=anonymous&cd23=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cg1=&cd21=Bristol&cd22=flex-editorial&cd30=45&cd31=Sunny&cd75=0&cd76=%20%20%20%20%20%20%20%20%20&cd79=&cd80=&cd81=No&cd82=&cd85=yes&cd86=no&cd102=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F119.0.6045.199%20safari%2F537.36&cd103=Undefined&cd104=Undefined%2C%20Undefined&cd105=3&cd106=Page%20View&cd107=0&cd111=undefined&cd115=notset&cd116=No&cd117=No&cd124=dsv3&cd129=0&cd130=no&cd89=1723897376.1701362458&z=2067305642

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 19ms
19ms XHR
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-54716522-2&cid=1723897376.1701362458&jid=874783360&gjid=403341364&_gid=931987926.1701362459&_u=aCDAiUAjBAQCAGAEKAB~&z=1745675655

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 18CA 15 KB
6 KB 55ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=heraldcourier.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 16:40:58 GMT
server: Kestrel
server-processing-duration-in-ticks: 321815
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame A7F8 84 KB
31 KB 20ms
18ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3569421
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: mhdmMEelucQy-jj-gb2z-wICF0FNZ-UG59S_p5laCv4yg_V8us-ZQw==

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame A7F8 202 KB
64 KB 76ms
75ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Nov 2023 16:40:59 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
12 KB 321ms
320ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=4019335874870734&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527%2C676982961&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250%7C970x90%7C728x90&ifi=6&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D59c0a0fc9107adc4%3AT%3D1701362458%3ART%3D1701362458%3AS%3DALNI_Mbg_pQP_z9ZIBCzf-fL0to-RggATA&gpic=UID%3D00000cff7853dec2%3AT%3D1701362458%3ART%3D1701362458%3AS%3DALNI_MY_XBvrMx5yna3nSBqpkkjbT3cumA&abxe=1&dt=1701362459298&lmt=1701360325&adxs=315&adys=736&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1600x250&msz=1600x250&fws=4&ohw=1600&psts=AOrYGsndJxhV8txeKqTKbjyz3oljm2-MMCQQZbZ4EXXQCrfmXKQj0nl97u2Dna77oQnHVtplgaWyL57e5wS3Hucl%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskcatGR88mAUXNupyrceQUDVBGocQRvJi16_OSi0wXYeB2V03kPuh1x0xaxZTwEr20d5gFYHu-R7FZCoR6T4tupUn-qEg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEjsKCnB1YmNpZC5vcmcSJDY1Njk4YWYwLWNjNjUtNDY2Mi04NTU2LTZjZmZlODBmNzQwMRjTwOuIwjFIABIYCgl5YWhvby5jb20Yjr7riMIxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGI6-64jCMUgAUgIIZBIXCghydGJob3VzZRiOvuuIwjFIAFICCGQSFAoFb3BlbngYjr7riMIxSABSAghkEhkKCnVpZGFwaS5jb20Yjr7riMIxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiGxeuIwjFIAFICCGo.&dlt=1701362457275&idt=1034&ppid=65698af0cc65466285566cffe80f7401&prev_scp=pos%3Dbreakout_top%2Cbtf%26density%3Dstandard%26lee_group%3D10%26lee_hours%3D16%26lee_day%3D4%26amznbid%3D2%26amznp%3D2&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=1369108146&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92e36389c6a82d00501f3b1f1ab31e4ba4b733ce714a4c6f4b69e8f5969d174d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12316
x-xss-protection: 0
google-lineitem-id: 6224511101
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138423397597
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
17 KB 279ms
279ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1771547888462305&correlator=4182694835011563&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527%2C676982961&output=ldjh&gdfp_req=1&vrg=202311280101&ptt=17&impl=fif&iu_parts=8438%2Cheraldcourier.com%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250%7C970x90%7C728x90&ifi=7&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D59c0a0fc9107adc4%3AT%3D1701362458%3ART%3D1701362458%3AS%3DALNI_Mbg_pQP_z9ZIBCzf-fL0to-RggATA&gpic=UID%3D00000cff7853dec2%3AT%3D1701362458%3ART%3D1701362458%3AS%3DALNI_MY_XBvrMx5yna3nSBqpkkjbT3cumA&abxe=1&dt=1701362459312&lmt=1701360325&adxs=315&adys=2137&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fheraldcourier.com%2F&vis=1&psz=1584x250&msz=1584x250&fws=4&ohw=1600&psts=AOrYGsndJxhV8txeKqTKbjyz3oljm2-MMCQQZbZ4EXXQCrfmXKQj0nl97u2Dna77oQnHVtplgaWyL57e5wS3Hucl%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGskcatGR88mAUXNupyrceQUDVBGocQRvJi16_OSi0wXYeB2V03kPuh1x0xaxZTwEr20d5gFYHu-R7FZCoR6T4tupUn-qEg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1723897376.1701362458&ga_sid=1701362458&ga_hid=1941353069&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYjr7riMIxSABSAghkEjsKCnB1YmNpZC5vcmcSJDY1Njk4YWYwLWNjNjUtNDY2Mi04NTU2LTZjZmZlODBmNzQwMRjTwOuIwjFIABIYCgl5YWhvby5jb20Yjr7riMIxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGI6-64jCMUgAUgIIZBIXCghydGJob3VzZRiOvuuIwjFIAFICCGQSFAoFb3BlbngYjr7riMIxSABSAghkEhkKCnVpZGFwaS5jb20Yjr7riMIxSABSAghkEhsKDGlkNS1zeW5jLmNvbRiGxeuIwjFIAFICCGo.&dlt=1701362457275&idt=1034&ppid=65698af0cc65466285566cffe80f7401&prev_scp=pos%3Dbreakout_middle%2Cbtf%2C60%26density%3Dstandard%26lee_group%3D6%26lee_hours%3D16%26lee_day%3D4%26amznbid%3D2%26amznp%3D2&cust_params=k%3Dbreaking%2520news%252Cweather%252Ccrime%252Cpolitics%252Centertainment%252Clifestyles%252Csports%26sub%3Dno%26page%3Dhomepage%252Capp-editorial%252Cmd_screen%26browser%3DChrome&adks=3126890831&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca9bcf3ddc23ac49985ff8e9c25034e354741f54331064120f2cf7294e0e7dcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17626
x-xss-protection: 0
google-lineitem-id: 6417910000
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138455125200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
277 B 70ms
10ms Fetch
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

3568ea19f66339e3b9a87af24fec75d33a3c6aca980c6d1e859e60afad81356f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Thu, 30 Nov 2023 16:40:59 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
495 B 87ms
27ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: d43cfd0265fea9e55f9e4ce7557b1f249746d2685a4da2f72580779dfa7d5e39

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: e62efcd0ce3884f37b77d0206190342e
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 37ms
36ms XHR
application/json 34.255.67.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.67.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-67-121.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 8834f8e188c21ece20d6c8a0b3b5de7cacc06d7a41f8b7768b28a59df09fefdf

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache
x-server: 10.45.20.136
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
214 B 114ms
34ms XHR
application/json 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fheraldcourier.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://heraldcourier.com
content-type: application/json
access-control-allow-credentials: true

POST
H2 200 /
heraldcourier.com/tncms/tracking/classifieds/featured/ 0
152 B 89ms
87ms Ping
application/octet-stream 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/tncms/tracking/classifieds/featured/?i=a6cb2bef-b55b-588f-a72b-049dc00b3324,
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
real-hostname: heraldcourier.com
cache-control: s-maxage=0, private, no-cache
x-vcache: MISS
age: 0
content-length: 0
content-type: application/octet-stream

POST
H2 200 /
heraldcourier.com/tncms/tracking/business/block/ 0
152 B 90ms
88ms Ping
application/octet-stream 192.104.183.109
LEE-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://heraldcourier.com/tncms/tracking/business/block/?i=e082a1d9-a578-5048-86da-3921c38b5b45,7335bb1b-c4f5-5673-b887-95ceda587fe6,26bd1ed3-4604-5ba0-8da0-aa335e12869b,
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/shared-content/art/tncms/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.104.183.109 , United States, ASN10668 (LEE-ASN, US),
Reverse DNS: cms.newyork1.vip.townnews.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
real-hostname: heraldcourier.com
cache-control: s-maxage=0, private, no-cache
x-vcache: MISS
age: 0
content-length: 0
content-type: application/octet-stream

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame DFB6 0
0 50ms
49ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvxT9zNoIoCKyqYWwUEwMNqkNb7NvZQU5JZZcX96C63gbRNJw51DLxYU4sHSHei7PJ0a3XnWkptl46QYBz_eLTKcET48Mtvmj6F2atcW43GkNHsdxOeZX3xLq5ADohgVdBCjdAiWjo430Tnasl65qB_pOroPrPjw3MWGzpYKfVQIxhbXdreb87o_ca-8iw4BMzXiSP1eQjtqB5A0XAVq6mBjfrPgg6MDg1O-Tg6EMEwrjqZV17YubbHKiQ5baZaSdtSsWRdJdV-3evFYSpYcoHtmgZrzw-l81zCkSOcCoJuRi4wLuhGUOfjHFqRU0uiuNibkAEJQiDGjirpxjk0MKNofejrWK_vh-8&sai=AMfl-YTikf5XNmEBiALFWsiNgBydKAyb8fYTNJ8yVrZPN67ZITacQyGXUjJ2nwcc7IGbslcPyuQeNR6nIURgK1puv0xpB-VpiQraFwzWesMtJG0e9GqVfoDXkzQrXcCKJZVJcsHiJ4lz4mAiDWRVUnCzhzZ2KG-Oct9c4sD3kQ&sig=Cg0ArKJSzNXE_UqyGNfqEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 30 Nov 2023 16:40:59 GMT

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/ 52 KB
4 KB 41ms
16ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css

Requested by

Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/shared-content/art/tncms/templates/libraries/flex/components/jquery/resources/scripts/jquery.min.d6d18fcf88750a16d256e72626e676a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 128831
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3279
last-modified: Mon, 04 May 2020 16:04:58 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d2a-ce35"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9QMPSeM%2F8QBja0kOwUwfTbJaWddHou1Qwuhw%2BvJHZIe1jW5I0ZkhK61Z850L3Pr4ncglf5XDTzedwN07EdOm2CmLSkwGpQpM69m%2BKjfkrSxyxtrB7FSmeZdEs9zqmxEW3LEGTdLpwb6p%2BA%2BXKmzTgaRQ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 82e4890c2b2c6acc-FRA
expires: Tue, 19 Nov 2024 16:40:59 GMT

GET
H3

200

1369886636433257115
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrf2_VRABGAEyCFhQrjHgP-WC
https://tpc.googlesyndication.com/simgad/1369886636433257115

152 KB
153 KB

12ms
10ms

Image
image/jpeg

2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1369886636433257115

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86660ef44d06ab8ca08059da26d814a85c5429eedd7c5f48c88bfcced3525fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:02:24 GMT
x-content-type-options: nosniff
age: 297515
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 156140
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 20:22:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 26 Nov 2024 06:02:24 GMT

Redirect headers

date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://tpc.googlesyndication.com/simgad/1369886636433257115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 30 Dec 2023 16:40:59 GMT

GET
H2

200

4135096395794578540
tpc.googlesyndication.com/simgad/
Redirect Chain

https://tpc.googlesyndication.com/pagead/imgad?id=CICAgODZrfPo3AEQARgBMgjIkoSCyqD0Kw
https://tpc.googlesyndication.com/simgad/4135096395794578540

62 KB
63 KB

9ms
8ms

Image
image/jpeg

2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4135096395794578540

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101184683ffdeec2ca9f83c6f7416fceec9b7b7e9cda1957125aef24dd4179d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:02:24 GMT
x-content-type-options: nosniff
age: 297515
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63662
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 20:22:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 26 Nov 2024 06:02:24 GMT

Redirect headers

date: Thu, 30 Nov 2023 07:27:06 GMT
x-content-type-options: nosniff
server: cafe
age: 33233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/4135096395794578540
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 30 Dec 2023 07:27:06 GMT

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/ 4 KB
1 KB 25ms
9ms Fetch
application/json 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/settings
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eec1d339b9dac9ef9991e418a6fd71c2cf953d77ed1597ed68f82fcc12bf7767

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: 8wBdC1fvjthSTrFspxDO4VzVvdAFdrfL
content-encoding: gzip
via: 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
date: Thu, 30 Nov 2023 15:35:16 GMT
x-amz-cf-pop: FRA6-C1
age: 3944
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 09 Oct 2023 16:01:47 GMT
server: AmazonS3
etag: W/"b1f2fbddf3135863ad45acc993d27497"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=10800
vary: Accept-Encoding
x-amz-cf-id: _EET9pKOGzWFV5CL-zjlrl78Zk_jgw2VY_GhOhmu1I7Lsw8wgi1e4Q==

GET
H2

200

sid Show response
mug.criteo.com/ Frame 18CA
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=heraldcourier.com&sn=ChromeSyncframe&so=0&topUrl=heraldcourier.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=4hpCh3wybUtoRy96UXdnSDltTVY2d0dsamlCMUNCS09ZM3BWZVlyT0JiSTJHcjBKQ1V4NHFLajZsbmhseFFER0UrWjNrT1RpSkFoczdub09lZkxNT1NudnN2NzFSRlMya2tudGRkbFdLZHcydllnSjZOZWZjZWtLT0FMYV...

468 B
676 B

20ms
18ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=4hpCh3wybUtoRy96UXdnSDltTVY2d0dsamlCMUNCS09ZM3BWZVlyT0JiSTJHcjBKQ1V4NHFLajZsbmhseFFER0UrWjNrT1RpSkFoczdub09lZkxNT1NudnN2NzFSRlMya2tudGRkbFdLZHcydllnSjZOZWZjZWtLT0FMYVRoNjlySkFuUUhkVnRySGN2QytoMzU5NnpSejZLbTYwQXJZb3FwWXJ5cGpSWHEwYjVibHZYV1ZqVDNpdWswWTVzbnAwZ1pjNHhtcFhTMDdPK0twQ2dhU1V5VGNQVTFvLzJUeVdNSjVNcjd5OEwzSHBsR2RlQVorQUp2SmxiVU01Ri9qcEh6WDIrekUvVTZpRmVNc0ZWNXFpbW1JMndXZz09fA&cppv=2

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7dd00f2a03b96cd5ff6072e11918eb5f555c99125f0a84d7dac2391a8a32dc63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3208554
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=4hpCh3wybUtoRy96UXdnSDltTVY2d0dsamlCMUNCS09ZM3BWZVlyT0JiSTJHcjBKQ1V4NHFLajZsbmhseFFER0UrWjNrT1RpSkFoczdub09lZkxNT1NudnN2NzFSRlMya2tudGRkbFdLZHcydllnSjZOZWZjZWtLT0FMYVRoNjlySkFuUUhkVnRySGN2QytoMzU5NnpSejZLbTYwQXJZb3FwWXJ5cGpSWHEwYjVibHZYV1ZqVDNpdWswWTVzbnAwZ1pjNHhtcFhTMDdPK0twQ2dhU1V5VGNQVTFvLzJUeVdNSjVNcjd5OEwzSHBsR2RlQVorQUp2SmxiVU01Ri9qcEh6WDIrekUvVTZpRmVNc0ZWNXFpbW1JMndXZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 304418
content-length: 0
expires: 0

GET
H2 200 /
www.facebook.com/tr/ 0
186 B 33ms
7ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=961211893969940&ev=PageView&dl=https%3A%2F%2Fheraldcourier.com%2F&rl=&if=false&ts=1701362459573&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1701362459566.1881441532&cs_est=true&ler=empty&it=1701362458592&coo=false&rqm=GET

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 30 Nov 2023 16:40:59 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 33ms
8ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=961211893969940&ev=Domain&dl=https%3A%2F%2Fheraldcourier.com%2F&rl=&if=false&ts=1701362459575&cd[custom_param]=undefined&sw=1600&sh=1200&v=2.9.138&r=stable&ec=1&o=4126&fbp=fb.1.1701362459566.1881441532&ler=empty&it=1701362458592&coo=false&rqm=GET

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 30 Nov 2023 16:40:59 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A7F8 0
0 47ms
46ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvh7xTKLHReMTt53uzj605BOzjTgA1GeE3QIGqlp9PanH1LONkb4b3NhiS6meNoCrjcorQIP51FrHrNJ3NetSX_aIiJgRgKJrZdV3DiieTGNvwUR4dF0gP-IwdZLM3efw2T4UD0Y48IWcGVGxH6QyPQw4hzvtb6sc6m_SZVURx8QoEQkcqSUTMzb9gjqw7nJe6-8dex1qQEIjEo4YZwouQ88y9ENhTdPkW__iEmzgztjuiGIcTIVDoAsCUYxY833hiKUcPu7GWHvDMRHWd8B-djKLPqWPi0sHD0oneugOmlq2ODitw7CpYdUb_mgBGErFtLQvRxLfdxTa1gdJtX_9Eq1glXiS7w-1EAlf9MZVvfJIMLe-2i3T_WvUQ&sai=AMfl-YS14A6sLeylbvD8letvWHHsivC1sQzadNqKe7ELIMlSDTNchgvU3Q8agyfgLc0ma6lF2hpzhiovfoSoPV1bsm4AFG2ZAndCcgNlw7GEF_PfeuWJ80QjKHZnmr9jRg3QqRjzp5iVHxO8YprfNst-GNW7foWuM6SeesBIEg&sig=Cg0ArKJSzOiUzZadWqMDEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ Frame A7F8 619 KB
164 KB 113ms
26ms Script
application/x-javascript 2.16.185.46
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.16.185.46 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-185-46.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7310e401efd5214d7c4baf2a6df94becd6d945da0682fbc3a93274eadc68e8c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Thu, 30 Nov 2023 16:40:59 GMT
Content-Encoding: gzip
x-amz-request-id: WN6CRNGBC7Q5EKK0
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: eOCsc9yceo4S4lv+W9OuH2eGmzxz+yVTuIOlwGlBoTdYajiqC8+FuFdyq8QUQV3rRTJN+M814is=
Last-Modified: Wed, 15 Nov 2023 00:44:41 GMT
Server: AmazonS3
ETag: "4fbba8ffe8ed5e2e12f43893b989ffc1"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
409 B 85ms
44ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-54716522-2&cid=1723897376.1701362458&jid=874783360&_u=aCDAiUAjBAQCAGAEKAB~&z=1673730087

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
108 B 46ms
44ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-54716522-2&cid=1723897376.1701362458&jid=874783360&_u=aCDAiUAjBAQCAGAEKAB~&z=1673730087

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame DFB6 0
0 71ms
54ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstIhcXFzF0GhGDJlxHZxRlH6zcemIVeZ2qMVL7ZCI0KmNmj2ICaatflATp6dCKKWqZVvE9rGxTQLm-QgZsABzQN48CAW5d0gFUO4vBpssZ2E59bCrkk6i23b5XyIKJIBR6fJvIx1JuA1ZvvAjFbsKV2Le3ysXKgihVpSev97pbJqi0Lu2qWHugxY43Asm8nlrAWh_IDYdCO09LmPnDDW2moR-y78GdqY-uxWw9_AU1z4fXn7UlvBMy3bFHvPgGiKRyYxTs-31cuijrFnyIZQnI7N9s2NMySmGgBLSOEbum0_DceaNqekLhmVKmc7d0GegvVCsZyhv0zChyft1ll5KkeF1fenZLea0_YNg&sai=AMfl-YTkEGK3Nxj5Gx8msHsSRi-Jn-h9RJffIDLFZKCpt7dm_JXDpiTvWi4AdJ5RewFO3Zb5s4vzPExOg4a2J3n4SUAmdPgerl7TBQGwrqiNvayB2BLm52T6D_69PwmNkiJK9iNLio_MrZgCX0j4--bqB69-KCidx0yExm1nig&sig=Cg0ArKJSzOPHl2zupWo5EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 30 Nov 2023 16:40:59 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
55 B 18ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-4T2EB147B8&gtm=45je3b60v887101457z8861227858&_p=1701362457537&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1723897376.1701362458&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dt=heraldcourier.com%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&dl=https%3A%2F%2Fheraldcourier.com%2F&sid=1701362459&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.canonical_url=https%3A%2F%2Fheraldcourier.com%2F&ep.townnews_crm_group_id=272&ep.generator=BLOX&ep.generator_version=1.71.9&tfd=3527
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 21ms
19ms Ping
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-4T2EB147B8&cid=1723897376.1701362458&gtm=45je3b60v887101457z8861227858&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-4T2EB147B8&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 51ms
50ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-4T2EB147B8&cid=1723897376.1701362458&gtm=45je3b60v887101457z8861227858&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=168763388

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:40:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame A7F8 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e11d0def4d95110dcdad915b0f8776ca43150f0b1bda9b09715f738d49bad7ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame F9CD 84 KB
31 KB 17ms
13ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3569422
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: -95hJ_qmBeWe2mGOjCXWR5-cVmhcSx_cyRDAS9W3IudhtFjiksFEjg==

GET
H3 200 13124561810826208673
tpc.googlesyndication.com/simgad/ Frame F9CD 49 KB
49 KB 11ms
8ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13124561810826208673

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab37f0162374a31204d5f9b472406caf196aee2f662f8ec741bc063bbd22ca20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:32:30 GMT
x-content-type-options: nosniff
age: 299310
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50258
x-xss-protection: 0
last-modified: Wed, 22 Nov 2023 19:33:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 26 Nov 2024 05:32:30 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231128/r20110914/client/ Frame F9CD 3 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231128/r20110914/client/window_focus_fy2021.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 13:10:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12623
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 14 Dec 2023 13:10:37 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F9CD 0
0 18ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQNSZRcNGwa0CHl6u8Jf8aA_55oVGaCFN4_djq9JibpY5yAeSHct68i9v7a-RuLvH3FdeYKz6_k6jiCMYEfmy7Mpqkttw
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F9CD 202 KB
64 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Nov 2023 16:41:00 GMT

GET
H2 200 b-e09f10f-fd9abb4c.js Show response
tagan.adlightning.com/leeenterprises/ Frame E9CB 84 KB
31 KB 18ms
17ms Script
application/javascript 18.65.39.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.65.39.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-65-39-76.ams1.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 20 Oct 2023 09:10:39 GMT
content-encoding: gzip
via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
x-amz-version-id: zhzD0.k4yK1QATUF8Zyk6eChx2be4yrB
x-amz-cf-pop: AMS1-P1
age: 3569422
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31504
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:26:07 GMT
server: AmazonS3
etag: "9906aff1d286210259bcaf608003dd01"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: dqroQ5CjR1hLiNJxLg7ob2Mw7eMAJvM__ZbsQcmdP0qVEEW9Vh9ERA==

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ Frame E9CB 4 KB
3 KB 84ms
27ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a2877d35b782162338bb95faedfa08559e23788db9d926e97da4d0efd2dbfc5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 14 Nov 2023 15:31:57 GMT
server: cloudflare
age: 4825
etag: W/"1045-60a1e7cae1276"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 82e48910d9265d49-FRA
expires: Thu, 30 Nov 2023 16:20:35 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E9CB 202 KB
64 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 Nov 2023 16:41:00 GMT

GET
H2 200 64c0a8cc3291c.image.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/7d/07d01b4d-4b4b-527b-aebd-c89b3b0c0167/ 15 KB
15 KB 129ms
127ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/7d/07d01b4d-4b4b-527b-aebd-c89b3b0c0167/64c0a8cc3291c.image.png?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f65079c7844584bf156ebb99949a883280f65cc817eab327c170d766c2a4fa5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=18498
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="64c0a8cc3291c.webp"
content-length: 15462
cf-bgj: imgq:85,h2pri
last-modified: Wed, 26 Jul 2023 05:02:04 GMT
server: cloudflare
x-vcache: MISS
etag: "9035ad7cba3e6f502040cf01647323a9"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e48910ad65904c-FRA
expires: Thu, 28 Nov 2024 11:15:18 GMT

GET
H2 200 6554627499b55.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/6c/d6c91e2f-099d-558b-ad0b-0aed38832a22/ 8 KB
8 KB 115ms
114ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/d/6c/d6c91e2f-099d-558b-ad0b-0aed38832a22/6554627499b55.image.jpg?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4212eef2876eb083a172b80c748943d9bc27361dfbc8268aa6ee786eee71c5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=9864
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="6554627499b55.webp"
content-length: 7740
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Nov 2023 06:17:24 GMT
server: cloudflare
x-vcache: MISS
etag: "aceb371e5ab61a1ebcdf398c2f943f35"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-robots-tag: noarchive
cf-ray: 82e48910ad66904c-FRA
expires: Fri, 29 Nov 2024 10:58:39 GMT

GET
H2 200 64ace55a38d5a.image.png
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6b/06bf355c-10c4-5ea5-a3e1-88032058e4be/ 59 KB
59 KB 142ms
141ms Image
image/webp 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/0/6b/06bf355c-10c4-5ea5-a3e1-88032058e4be/64ace55a38d5a.image.png?crop=600%2C338%2C0%2C13&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cb9ec628a3a88428ab0dd29413e716c930932b4175133aaaf33a9a69d6332da

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=119630
cross-origin-resource-policy: cross-origin
content-disposition: inline; filename="64ace55a38d5a.webp"
cf-bgj: imgq:85,h2pri
last-modified: Tue, 11 Jul 2023 05:15:06 GMT
server: cloudflare
x-vcache: MISS
etag: "f2d855a1f1bfa7e02e3762f4009489e6"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e48910ad67904c-FRA
expires: Wed, 27 Nov 2024 10:15:28 GMT

GET
H2 200 655462822cbb4.image.jpg
bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/ba/aba13f18-a6c4-5a92-8146-b65244ea1764/ 13 KB
13 KB 113ms
113ms Image
image/jpeg 104.16.133.24
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/assets/v3/editorial/a/ba/aba13f18-a6c4-5a92-8146-b65244ea1764/655462822cbb4.image.jpg?crop=600%2C338%2C0%2C31&resize=400%2C225&order=crop%2Cresize

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.133.24 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dae66852e0a17c8a1bb1050b6e3c4f2c10e3aff0d390a59f4ae26a481ca53a9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
strict-transport-security: max-age=604800
cf-cache-status: HIT
cf-polished: origSize=13409, status=webp_bigger
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Nov 2023 06:17:38 GMT
server: cloudflare
x-vcache: MISS
etag: "249d0c9d945d1040ac25931689e99eb2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-robots-tag: noarchive
cf-ray: 82e48910ad68904c-FRA
expires: Thu, 28 Nov 2024 22:27:43 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 16ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S5LKEZJN96&gtm=45je3b60v893785645&_p=1701362457537&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1723897376.1701362458&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1701362458&sct=1&seg=0&dl=https%3A%2F%2Fheraldcourier.com%2F&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&_s=2&tfd=3975
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 v3 Show response
id5-sync.com/gm/ 319 B
602 B 27ms
8ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

6b1660dd464d92df64233234b29c58d080cb44d4f867d9ae61b0023cb958687b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Thu, 30 Nov 2023 16:40:59 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame CB3C 0
167 B 74ms
17ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Thu, 30 Nov 2023 16:41:00 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 ajs-destination.bundle.13362ca512563a10e34d.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 15ms
9ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.13362ca512563a10e34d.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7e4fde2a7e2da4eb11065a29f03b7f68566665515cf79bf4841168b46508dda5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 20:48:28 GMT
x-amz-version-id: p6tk_itArJhm1.zmwaH5aXhODx_TUmzt
content-encoding: br
via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 1281153
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 15 Nov 2023 20:12:01 GMT
server: AmazonS3
etag: W/"0dec480089dae7da1834489f95aca4e7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: ShFOzqzO50lwgVu5veSE0Wy5E6BW4WZrVWxIpQW4FEQRkY0Z4_H-Jg==

GET
H/1.1 200
OK a-058n Show response
i.liadm.com/s/c/ Frame E62F 583 B
865 B 810ms
99ms Document
text/html 44.215.169.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&euns=0&s=&version=v2.11.1&

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.215.169.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-215-169-187.compute-1.amazonaws.com

Software

Resource Hash

543794f3bcbf9a65ede077b769e3ec28172464917a91d6670f42f6664c4ca0d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 414
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Nov 2023 16:41:01 GMT
Request-Time: 8
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK baker
sli.heraldcourier.com/ 19 B
370 B 650ms
27ms Image
image/gif 2a02:26f0:480:23::1726:62ac
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.heraldcourier.com/baker?dtstmp=1701362460386
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:62ac Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Expires: Thu, 30 Nov 2023 16:41:01 GMT
Pragma: no-cache
Date: Thu, 30 Nov 2023 16:41:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F9CD 0
0 49ms
49ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPvgCRoqCWzz9DeKOFhM3V2bjsq2_i9gvxcrEIOIjgTrd1fSSVt9_jnmtBhLtkEfYBcl50001EnkB9c7wtwxGTA_nKDX0jPTPAUqkK5yxxEYdj_vlXtCRSCnjnTEspT36DuNixBwTpc1oBSBg1KvxhYiBWOFiZOfjmepJmO8TUV9fo1f6oroCbbSWhMlO2D3TGUxVomf0jGeoDDOhfYQDzuzLYcL37rWe1Dp7B5urGCdjTHALKpIDMxbwVm-1fO-s_2D78MOQHZKeUJwgagrAMs-lyMFgCd1sxFNjYFUL5ZoWIoErXIqRxa35sNCrAWszW5Gm0ubJetOHbHel2_sADcD4nNI6SdBW5ACLsw1f6LdTV4-Jvj517ZTE&sai=AMfl-YSRoz6dSzV0Ri2dpm86J0nCc9VpihZESSOu10aZ972AL-IK61qnPTN-B27TbzdqmmHB7zuiYrcFDKdA1OJr4eDr5qHxKv6U1oA5hYFz0vNVT-9Jhy-DwT9fitTHXihcoEHxVPuN2MvQ6J7VqRYkLBH8fNXj43qijaE2&sig=Cg0ArKJSzE_Bxt0ZzSexEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F9CD 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f89185a0930e1e12fc54b268c6bcf84bf2b1161065dcb3ee89f6bc78b937d60

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E9CB 0
0 51ms
50ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfAX-MOPF3VJX2D22xWCV13WZ5Tz9TCAmDOiSMy7S-K4DkdBcpZWde0NxLDGvV8eIBOlJf_HeDG8GlkBvwPK3m-8rJJWv21CKUJ1_TyTN68fjwvj6hlojMu89M2sDZQZiZ8V0G2852WekySNTh8HH6OnzXARo1ox-ZDz8Jyx9vD-TpBfde_xeNxBUsHR94SwGp4Q4jB8svk2l60cshCHFieYGgwP11_NsLO5r9_h8cd34ybRArMzvBvOGfHZua7xkKcothgRyYkjmHtqL9aBYXxdU-B5CdrlX_Aq9xkWHaBQtJ4Kkw7scOQd8fmYBgidPUew3laQtobPIj8C1zmwdx5JlRFLbyzpuThGABpIjwjve01Zy3GX16fap1aLHqL44buIPWIXN63g&sai=AMfl-YTOcGs-R7flWI_3n2CfD3XDS9knnuG1tlKjwMzB5u-LvCtCVu3gdlhYrsxbBuejxMreJX_KL2SjQJ8dgNos5o2uUJfyEUoDP_lKqmvRSY6RYVznF0It408tIbqcDmzTdQBRqtXFq4O_0u7PuURWVpHmSCZP_oSRs7lU&sig=Cg0ArKJSzPism3_eEfTSEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 display.js Show response
jadserve.postrelease.com/ Frame A7F8 3 KB
2 KB 563ms
189ms Script
text/javascript 44.240.20.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/display.js?&ntv_m=1&ntv_z=native_ad_grid_v3&ntv_au=ntv909271321&prx_url=https%3A%2F%2Fheraldcourier.com%2F&rand=216965106.96482176
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.20.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-20-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 4f3170e6847314e4c12859f96c520b733b853d80c97744b0e27775744cc4c591

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
content-encoding: gzip
server: nginx
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 1171
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 frame_content.js Show response
resources.infolinks.com/js/1895.006-3.034/ Frame E9CB 2 KB
693 B 25ms
25ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/frame_content.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc3a41863d92b22799ff23c52e2173e80b13ebc75b9144151ea105cd52b59de5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:05 GMT
server: cloudflare
age: 12707
etag: W/"96d-6099387e645f0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82e489158eb55d49-FRA
expires: Sat, 30 Dec 2023 13:09:14 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F9CD 0
0 47ms
46ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuEn0m2-Y9ESf2QwHv8E4ppc85ni_OnZQdFHIKS_VVSYHwahETTUFnMhTgr4Xdti8uaegjTx_uFLm5WdPxLGBtyvlxgq8PaEgSn5ovEgiZQuf_Y6z0EEwEiXg7BhjVFM2YiVqqkj0lnqs9rN31oS6HrgEFgTcGFnjTQz3kJCVLgGNcP73F-8qyVBqgOzJGm3Xf97dK9F25ueCweW_7s8fCtatMStccLXo9NXrV-F3M-rnfkUSsuWTjKtiqNwEeQPwIxxw0L9GtgOkXd7NOoAs_02J4vZfQSs8oaoJBYH6M9kmQbS9HBse80fSAhUlQnaXyQ5mcUqyPrqZnWEKKWm_FWEaXoh7kR5FIVogN7Y8AkaHZdkTqAW_QoyBOexQ&sai=AMfl-YSMl9vwnLy1tr5rvz_0EcyIQ49csJP9LEmBO9kEtcyBV56uggGko54WJCJFWsI-CYLsRS2DEiy0CNCRMQRDGHQyOI6VWKmTSZ9Gy7A8dfCSPN5yonnBmjuoIBVtpwd1CwIBPgxEDtPqmIKV8jS_5Ww_X0CNb13990G5&sig=Cg0ArKJSzBUaLVKu79mfEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 30 Nov 2023 16:41:01 GMT

GET
DATA 200
OK truncated
/ Frame E9CB 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4f52d2893a7da88ee0656f797c61fa2a93e47caa8f4321a5bdd907a0faf7476

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
349 B 67ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=1771547888462305&vrg=202311280101&nw_id=8438&nslots=9&eid=31077976%2C31079831%2C31079783%2C31079856%2C31079527%2C676982961&pub_url=https%3A%2F%2Fheraldcourier.com%2F&qid=CLPfloiV7IIDFYZM4AodyrYEAA&iu=%2F8438%2Fheraldcourier.com%2Fhomepage&e=12288&ret=728x90&req=970x250%7C970x90%7C728x90&bm=0&efh=1&stk=0&ifi=7

Requested by

Host: heraldcourier.com
URL: https://heraldcourier.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 schemaFilter.bundle.f63551a29dc1697f71b6.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 9ms
8ms Script
application/javascript 99.86.8.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.f63551a29dc1697f71b6.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-8-175.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 01:37:17 GMT
x-amz-version-id: Q83vlLXgyWB6DuTGnFxHLMCEzu8jknn5
content-encoding: br
via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 5065425
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 03 Oct 2023 01:26:38 GMT
server: AmazonS3
etag: W/"2a359f6227308e4ee31623f9381ae1d7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: qZ0iJxo8Mj8Bx8wmPywS3Us0CABzrA9UzWfQ6JoH9CTnzjZ2b9eIMA==

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1895.006-3.034/ 187 KB
57 KB 27ms
25ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54eacec863498628814d62c486eca8cd1c580c77a4dda865b5941006e40c6e66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 6755
etag: W/"2ede2-6099387db510d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82e489163f875d49-FRA
expires: Sat, 30 Dec 2023 14:48:26 GMT

GET
H2 200 frame_inplace.js Show response
resources.infolinks.com/js/1895.006-3.034/ Frame E9CB 3 KB
1 KB 26ms
24ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/frame_inplace.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 851aab34e9b9e9c6252ed4a0bd57b30a79795aacdc7e036d7e824ed9e69b2807

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:05 GMT
server: cloudflare
age: 748
etag: W/"baa-6099387e6d293"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82e489163f8a5d49-FRA
expires: Sat, 30 Dec 2023 16:28:33 GMT

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
175 B 555ms
179ms Fetch
application/json 54.69.251.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/YNwPRuYDOjrAr7O9PCSVIw1QoK0Oimn6/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.69.251.6 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-69-251-6.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://heraldcourier.com
date: Thu, 30 Nov 2023 16:41:01 GMT
strict-transport-security: max-age=31536000
content-length: 21
vary: Origin
content-type: application/json

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E9CB 0
0 45ms
45ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstDw3AzqlVc7sMC5R94d7_9LAMOaLUC3ph8VYznyC52bQQoSSJ4CQGaTA2bhyC5Roo4QnEgh3vC_gqgZt2Eew39AuOVyzDsZLIy4bf5MTZj5RKpIzV6blrJK1bbpFbOihETeoAt1LP0rlpv6sYDFUCh-ib19BdCUQwdbJIcAReXTB_EUnVKbmqd35ZcUYKpAtD0NSlPY4sP0DhiWYvF-7YRxWmbYWwzVem7mJY8BvBac3iN-iJzeqAHQEv7qroKXm1oUfO8MPCGh7yt9SqqmhF5yn2TT0FJk-YbhpayiD2RQNIq0BzRJq_lfwDPqQN3SiLwa8WMqzzXJuzhxNN68qH18gvI5C0FzDHam2v9VYsJbs7KK74k-F8FHeqpgw&sai=AMfl-YQQGMjoAMGoevdgZlUQ94LEkHSZKaRbkpWIazNI7hXp-weKtviqcN9Cj-TDF73QCNyrDrzeiWq9Kk8M-Ll-oTdIuTecxftsjebXIH4fhvrWf2LqoaUIxNVpugG7iQCqmdD1EXQkVr-q3QsT6QLf8ABaWjqg1VOPh_L3&sig=Cg0ArKJSzHemYIpIVI7BEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 30 Nov 2023 16:41:01 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 7527 0
33 B 166ms
140ms Document
text/plain 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3384910&wsid=0&pdom=heraldcourier.com&purl=https%3A%2F%2Fheraldcourier.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 82e48916d84c5d49-FRA
content-length: 0
date: Thu, 30 Nov 2023 16:41:01 GMT
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 0
43 B 129ms
124ms Script
text/plain 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3384910&wsid=0&pdom=heraldcourier.com&purl=https%3A%2F%2Fheraldcourier.com%2F
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 82e48916d84e5d49-FRA
content-length: 0

GET
H2 200 gsd Show response
router.infolinks.com/ 314 B
511 B 131ms
130ms Script
text/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3384910&pdom=heraldcourier.com&purl=https%3A%2F%2Fheraldcourier.com%2F&jsv=1895.006-3.034&_cb=17013624612540
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b67ef5fd016f32a0a44093ba8544ff75d22f4d0cec5f0a8b77602d8519b472b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 82e48916d84f5d49-FRA
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

28292
i.liadm.com/s/ Frame E62F
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-xXJkFJEhQNgA6f_PKaBmjYCstYZshM39Cgf4Hg

43 B
573 B

95ms
94ms

Image
image/gif

44.215.169.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-xXJkFJEhQNgA6f_PKaBmjYCstYZshM39Cgf4Hg

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&euns=0&s=&version=v2.11.1&

Protocol

HTTP/1.1

Server

44.215.169.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-215-169-187.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Thu, 30 Nov 2023 16:41:01 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 3
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-xXJkFJEhQNgA6f_PKaBmjYCstYZshM39Cgf4Hg
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 880340
content-length: 0
expires: Thu, 30 Nov 2023 00:00:00 GMT

GET
H/1.1 200
OK a-058n
i6.liadm.com/s/c/ Frame E62F 0
0 380ms
91ms Image
text/html 2600:1f18:ed:550e:958:d678:1b00:5c96
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i6.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&version=v2.11.1&s=&euns=0
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-058n?duid=3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5&euns=0&s=&version=v2.11.1&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:ed:550e:958:d678:1b00:5c96 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

POST
H2 200 doq.htm Show response
rt3054.infolinks.com/action/ 812 B
889 B 190ms
149ms XHR
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3054.infolinks.com/action/doq.htm?pcode=utf-8&r=17013624614041
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c054398e126946f73da870c3417acce050f5c796ecc3878b64cd64d723557e3

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: de-DE
cf-ray: 82e489181f3a6977-FRA
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 moatcontent.js Show response
z.moatads.com/nativonielsen548znrb18/ Frame A7F8 167 KB
55 KB 50ms
7ms Script
application/x-javascript 23.213.165.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/nativonielsen548znrb18/moatcontent.js?moatClientLevel1=19446
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.213.165.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-213-165-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
content-encoding: gzip
last-modified: Mon, 24 Aug 2020 17:04:05 GMT
server: AmazonS3
x-amz-request-id: 541CA3CB462144FD
x-akamai-ew-subworker: 8096267
etag: "774acff2cee5852cdfc3fd8471cb2667"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=61738
accept-ranges: bytes
content-length: 55696
x-amz-id-2: WNwhnB94WoMq7DmM1MaoToceuK3QbHC7vn11hUldfKqO5oRdP3/lkIWqAFpXgth7b2BO5KLt3DE=

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
422 B 181ms
181ms Image
image/gif 44.240.20.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=1452231&ntv_pl=1173341&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.20.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-20-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
422 B 190ms
189ms Image
image/gif 44.240.20.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=4f54aca7-e074-4146-b5a7-320e5f20c574&ntv_fl=BWZZiTvTzpc2ehvfNnYVIWqFRzCyGsChK0NiWXbOHwlCmY4onTPan4hunB4tcFJ-lD0BwORe1q2_CBmpKHvgteQqkmeQRq_bsYmF6GimT8c87tfpzGdsUJZhP-26SY9voiNAQgntmeHWcrrhH1HDOQLtStzHFLL4BCJK9ruY_uPtL5VjkaoAm-FbqOP-fcFkKGsnWX75ipmVwve7RLr0PGyMnK046AnM2-Hm3_ObbXryh0qKdO8-g2DhsHvbwfIiGm1SJ6lsNizKF1ngtQWCsBZwTr4OyKwIEoy8W1oWP009sBNrQDqyfTTs1DZsFuBbhLfCMDo-RRG8YVeksM5N8GGBOb8rF5AjqGDDSVNqnx8cPiJ4dV9o51-oluXzL24k&ntv_ht=HbtoZQA&ntv_at=303,302&ntv_a=AAAAAAAAAAXecRA&ord=1701362461602&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F&ntv_it
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.20.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-20-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 privacyConsent
jadserve.postrelease.com/ 43 B
422 B 180ms
179ms Image
image/gif 44.240.20.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/privacyConsent?ntv_pl=1173341&ntv_gdpr_consent=&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F&ntv_it
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.20.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-20-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 in_place.js Show response
resources.infolinks.com/js/1895.006-3.034/ 35 KB
6 KB 25ms
25ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/in_place.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ea62c199514d68eed527ea54f5297b51d299636f30e91bc13606309488697ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 6183
etag: W/"8c81-6099387e08145"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82e489193afd5d49-FRA
expires: Sat, 30 Dec 2023 14:57:58 GMT

GET
H2 200 getads.htm Show response
rt3054.infolinks.com/action/ 554 B
526 B 170ms
170ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3054.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22u_IL_INPLACE_breakout_top_728x90%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22u%22%2C%22garc%22%3A0%2C%22as%22%3A%22728*90%22%2C%22sdata%22%3A%226%20months%22%2C%22scs%22%3A%22fszgsvfcAa%22%7D%5D&rid=dc2d673f-f851-4079-af0c-eeeb3e8a9c93&jsv=1895.006-3.034&sr=1600X1200&rts=1701362461658&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=119.0.6045.199&dv=p&ce=t&purl=https%3A%2F%2Fheraldcourier.com%2F&tzo=%2B0100&c=c&strg=true&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=5cn03_Z3b6qv67iknXCzqzICCbD9ToznUMACB6y-QAuUcCLeQVbCuJhaRi_42VZtC-r1W6-qo_lVzWyaitweshEQICESijnfu-M4wWz9kJ_wPlhy3JtR1pC_xZGZKRusJkcH9cZzOcATnFey8E6mwJ7v9SwhLlki&rsk=80&rcs=RPRbbEeGMz-BfVWOoR1AvA&cuid=323a4601-a9e0-4839-bb50-31d91688b936&hbnr=false
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 727e0151b25251f2298485fa57b50b0efe132c6ba1636cd25926fdc7035cbd30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: de-DE
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82e489196b405d49-FRA
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 19446 Show response
s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/ 0
275 B 421ms
406ms Script
application/x-javascript 23.213.165.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/19446?t=20231030178
Requested by: Host: heraldcourier.com
URL: https://heraldcourier.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.213.165.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-213-165-236.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
last-modified: Tue, 18 Nov 2014 20:18:12 GMT
server: AmazonS3
x-amz-request-id: B17D55F7DE27FB81
x-akamai-ew-subworker: 8096267
etag: "d41d8cd98f00b204e9800998ecf8427e"
content-type: application/x-javascript
cache-control: max-age=514
accept-ranges: bytes
content-length: 0
x-amz-id-2: mIU50l84eryBjMRqOnAd1Wue1SPq7w6EiQwUrn6rNchVVQCR2FTaNBeV7eOeh+EnU1pv9ak3kX4=

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A7F8 0
0 45ms
44ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuwO3YrpuOa-2dNI_aE1F9CwXCXpvsEYGDEp2Uko_jvEJ4E8t4Wno_qD2wGxc9EilRMGwN86lgan325oNuHdJ9cgm33NOPngTw4N7Oe9gycNowcKbYBsPCiLL1ucX45N-9gRU87LTsj-e4C1V-dP6Am_mvxbuK09_2r942qpAsiSB_dFiSQQfr-kmdf8abjntuFHQYNHexfr1VbSSlK9YJmJaaCJDndZvUCin5L07YqUdFAlYYni9W1hb9XUrs5MsBp38_MdyxnETCTMEaTvBheZ66zowsm0lkdGiXp4PPkyJsGT1-Mrq1WbztwQUcGz802rr2jSyEZkJJ5v1X-RFwIpWdMGyV4g8HAnuR_xiLxlFrlvtxcuUQxL2B1A&sai=AMfl-YQf8Ge9ZIihFAgqXZBFpIsFSs7ABW8LbIWzs-q9aE7eyWBNMSHexBHoZPwsB2CUXaGnp_VsjcE4FvrGyu5TF--SIhqPUpkTCpDRD_IMaW8mRiLYmQMMsJyox0Nvj9dC9LBFLOzjnwYVTB_LnwBIFLtCtEO4nvFRICeH1g&sig=Cg0ArKJSzBO39_NsJfzSEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 30 Nov 2023 16:41:01 GMT

GET
H2 200 dcl.htm Show response
rt3054.infolinks.com/action/ 0
37 B 152ms
151ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3054.infolinks.com/action/dcl.htm?rid=dc2d673f-f851-4079-af0c-eeeb3e8a9c93&jsv=1895.006-3.034&capara=%7B%22error%22%3A%22ICE_HB%20was%20not%20found%20on%20window%20-%20init%20not%20fired.%22%7D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:01 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82e4891a7d0d5d49-FRA
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adidas_2_728x90.jpg
resources.infolinks.com/static/brands/ Frame 1CAE 17 KB
17 KB 33ms
32ms Image
image/webp 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.infolinks.com/static/brands/adidas_2_728x90.jpg
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ee55d11fd7f62072a2ff737ff77dabd10935e2c1be5582e6a7ebe8748c9504a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:01 GMT
via: 1.1 google
cf-cache-status: HIT
age: 8157
cf-polished: qual=85, origFmt=jpeg, origSize=39289
content-disposition: inline; filename="adidas_2_728x90.webp"
content-length: 17272
cf-bgj: imgq:85,h2pri
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
etag: "9979-5f7533fc241a1"
vary: Accept
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 82e4891aad615d49-FRA
expires: Sat, 30 Dec 2023 14:25:04 GMT

GET
H2 200 adview.htm Show response
rt3054.infolinks.com/action/ 0
149 B 221ms
221ms XHR
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3054.infolinks.com/action/adview.htm?rid=dc2d673f-f851-4079-af0c-eeeb3e8a9c93&bdc=1&midx=0&emd=NTd-bnVsbF9udWxs&rts=1701362461861&prod_t=u&jsv=1895.006-3.034&sdata=6%20months&scs=fszgsvfcAa&rsd=5cn03_Z3b6qv67iknXCzqzICCbD9ToznUMACB6y-QAuUcCLeQVbCuJhaRi_42VZtC-r1W6-qo_lVzWyaitweshEQICESijnfu-M4wWz9kJ_wPlhy3JtR1pC_xZGZKRusJkcH9cZzOcATnFey8E6mwJ7v9SwhLlki&rsk=80&rcs=RPRbbEeGMz-BfVWOoR1AvA
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://heraldcourier.com
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 82e4891aaaf86977-FRA
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 80ms
64ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311280101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311280101/pubads_impl.js?cb=31079856

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2823072c1024e9a1991e9c1169a07eccf9ee235b27d76ed11a8a78f8ece5f82f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12325
x-xss-protection: 0

GET
H2 200 p Show response
i.simpli.fi/ 809 B
772 B 30ms
15ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=7855&cb=sifi_att_1768153694538195._hp
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: f70acf7447c35e77bb255248c4f9bdb9566bf67236b8026fc0683eb8382fd4e6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

/
s.ad.smaato.net/c/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=56EE9B2FA1994B1F85BFF04DE3320928

0
236 B

113ms
46ms

Image
text/plain

2600:9000:25e8:7400:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 2600:9000:25e8:7400:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, must-revalidate
via: 1.1 1cd1c24523b61d46b093d317bb196d92.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS1-P3
x-amz-cf-id: ceaQ8ovG3WHpxuxA-UfKE1DBihfuyIx4127UFmnlkTEYLmayLGjDyA==
x-cache: Miss from cloudfront

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

200

RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/56EE9B2FA1994B1F85BFF04DE3320928
https://sync.1rx.io/usersync/simplifi/56EE9B2FA1994B1F85BFF04DE3320928?zcc=1&cb=1701362462455
https://sync.targeting.unrulymedia.com/csync/RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003

43 B
378 B

212ms
65ms

Image
image/gif

46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003
Protocol: H2
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003
pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=56EE9B2FA1994B1F85BFF04DE3320928&dongle=yf3

37 B
140 B

47ms
9ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=56EE9B2FA1994B1F85BFF04DE3320928&dongle=yf3
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://eb2.3lift.com/xuid?mid=7969&xuid=56EE9B2FA1994B1F85BFF04DE3320928&dongle=yf3
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=56EE9B2FA1994B1F85BFF04DE3320928

43 B
175 B

318ms
91ms

Image
image/gif

2600:1f18:612b:4200:69f4:eef1:1a8c:a311
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 2600:1f18:612b:4200:69f4:eef1:1a8c:a311 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 30 Nov 2023 16:41:02 GMT
server: nginx
content-type: image/gif

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://simplifi.partners.tremorhub.com/sync?UISF=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928

95 B
436 B

30ms
26ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=56EE9B2FA1994B1F85BFF04DE3320928
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=56EE9B2FA1994B1F85BFF04DE3320928
https://d.agkn.com/pixel/10751/?che=1701362462287&ip=80.255.10.199&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217523104716003380185
https://um.simpli.fi/aa_px?sk=217523104716003380185
https://um.simpli.fi/empty.gif

43 B
361 B

17ms
17ms

Image
image/gif

35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: /empty.gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142

GET
H2

403

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=56EE9B2FA1994B1F85BFF04DE3320928

0
0

59ms
12ms

Image
text/html

18.239.69.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 18.239.69.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-69-3.ams58.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 19ms
17ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 22ms
19ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

204

cms
ups.analytics.yahoo.com/ups/58726/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=56EE9B2FA1994B1F85BFF04DE3320928;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=56EE9B2FA1994B1F85BFF04DE3320928;mimetype=img;sr
https://cms.analytics.yahoo.com/cms?partner_id=DATCS
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

0
15 B

10ms
9ms

Image
text/plain

3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

Protocol

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-store
content-type: text/html
server: ATS/9.1.10.87
content-length: 344
content-language: en

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0&xl8blockcheck=1

0
767 B

15ms
15ms

Image
text/plain

18.198.126.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0&xl8blockcheck=1
Protocol: H2
Server: 18.198.126.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-126-47.eu-central-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=56EE9B2FA1994B1F85BFF04DE3320928&j=0&xl8blockcheck=1
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 31ms
29ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=56EE9B2FA1994B1F85BFF04DE3320928

0
421 B

397ms
90ms

Image
text/plain

52.70.186.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: HTTP/1.1
Server: 52.70.186.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-186-203.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Connection: keep-alive
Date: Thu, 30 Nov 2023 16:41:02 GMT

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.bfmio.com/sync?pid=141&uid=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=56EE9B2FA1994B1F85BFF04DE3320928

62 B
445 B

240ms
157ms

Image
image/gif

23.192.153.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 23.192.153.172 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-153-172.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 30 Nov 2023 16:41:02 GMT
content-length: 62
content-type: image/gif

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://stags.bluekai.com/site/29931?id=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

404

tpid=56EE9B2FA1994B1F85BFF04DE3320928
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=56EE9B2FA1994B1F85BFF04DE3320928

49 B
264 B

35ms
31ms

Image
image/gif

34.255.67.121
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 34.255.67.121 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-67-121.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.24.32
content-length: 49
expires: 0

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H/1.1

204
No Content

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=56EE9B2FA1994B1F85BFF04DE3320928

0
311 B

80ms
30ms

Image
text/plain

216.52.2.91
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: HTTP/1.1
Server: 216.52.2.91 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Expires: Fri, 20 Mar 2009 00:00:00 GMT
Pragma: no-cache
Date: Thu, 30 Nov 2023 16:41:02 GMT
X-MERGE: GDPR Optout true
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

451

419566.gif
idsync.rlcdn.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=56EE9B2FA1994B1F85BFF04DE3320928

0
98 B

49ms
17ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/419566.gif?partner_uid=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://idsync.rlcdn.com/419566.gif?partner_uid=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1701362462168&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHi...
https://www.google.de/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHiZ...

42 B
64 B

25ms
23ms

Image
image/gif

2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHiZXsggMVB9e7CB1GZAp2&is_vtc=1&ocp_id=HrtoZdX0DYeu7_UPxsipsAc&cid=CAQSKQDICaaNJYCA8Mf5hWLJ9EtA8ZGTqUivgmAFWkKYRcd1PReiWB9k8hJC&random=1714407932&ipr=y

Protocol

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/1026675585/?random=1727025679&cv=7&fst=1701362462168&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1fvHiZXsggMVB9e7CB1GZAp2&is_vtc=1&ocp_id=HrtoZdX0DYeu7_UPxsipsAc&cid=CAQSKQDICaaNJYCA8Mf5hWLJ9EtA8ZGTqUivgmAFWkKYRcd1PReiWB9k8hJC&random=1714407932&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 32ms
30ms Image
text/plain 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=56EE9B2FA1994B1F85BFF04DE3320928
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D56EE9B2FA1994B1F85BFF04DE3320928

43 B
891 B

16ms
14ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D56EE9B2FA1994B1F85BFF04DE3320928

Protocol

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
an-x-request-uuid: 324e6718-111a-436d-8f42-c664a457c40a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.199; 80.255.10.199; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
an-x-request-uuid: cd00dd3e-45ec-4504-bb50-b0e018349c38
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3D56EE9B2FA1994B1F85BFF04DE3320928
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.199; 80.255.10.199; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=56EE9B2FA1994B1F85BFF04DE3320928&expires=365

0
239 B

65ms
15ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=56EE9B2FA1994B1F85BFF04DE3320928&expires=365
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 7d6e3b6fefbbeb4d018118d74243a2fc
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=56EE9B2FA1994B1F85BFF04DE3320928&expires=365
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=56EE9B2FA1994B1F85BFF04DE3320928

43 B
210 B

39ms
16ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=56EE9B2FA1994B1F85BFF04DE3320928
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=56EE9B2FA1994B1F85BFF04DE3320928
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 29 Nov 2023 16:41:02 GMT

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEGwjfcyTaJ6jmLitaocF0Ko&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=56EE9B2FA1994B1F85BFF04DE3320928
https://um.simpli.fi/g_match?id=

0
320 B

17ms
15ms

Image
text/plain

35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Wed, 29 Nov 2023 16:41:02 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://um.simpli.fi/g_match?id=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E9CB 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvb__BQ2OBFT8fIJ2tUqHr0Z1q51A8H9lxEKOPRTpEOiytnCMvX_K8_bdRtOVLvyCcxppHOCX_AsvLhK43kw0Rc2lEYDIun4gFeCoRNEdm4rGyJ241XFv_Cc9Pm93DAiUxBWILIhYXU5A&sai=AMfl-YRmKR9gYLEL5xAOzCK-5fJ8IxuUrq6MppU8idtYV8G4m29Teqk&sig=Cg0ArKJSzKe4tdtaT3lbEAE&id=lidar2&mcvt=1001&p=1028,436,1118,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231129&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1369108146&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701362460164&rpt=1012&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:41:02 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E05E 13 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 13:31:48 GMT
expires: Fri, 29 Nov 2024 13:31:48 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0C8F 829 B
560 B 20ms
19ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

69216f9d036fedc356b18f77c1124b104cbe8f53d7260abb2d0e3ab0ab9a4db6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-j456APRoiKKut4dUzBegHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-j456APRoiKKut4dUzBegHw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 30 Nov 2023 16:41:02 GMT
expires: Thu, 30 Nov 2023 16:41:02 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 load-cookie.html Show response
bidder.newspassid.com/static/ Frame B0CD 12 KB
13 KB 97ms
90ms Document
text/html 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 12255
content-type: text/html; charset=utf-8
date: Thu, 30 Nov 2023 16:41:02 GMT
expires: 0
last-modified: Thu, 30 Nov 2023 10:14:43 GMT
pragma: no-cache
vary: Origin

GET
H2 200 load-cookie.html Show response
bidder.newspassid.com/static/ Frame EEE2 12 KB
13 KB 183ms
180ms Document
text/html 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459292&bidder=newspassid
Requested by: Host: bloximages.newyork1.vip.townnews.com
URL: https://bloximages.newyork1.vip.townnews.com/heraldcourier.com/content/tncms/live/libraries/flex/components/ads_dfp/resources/scripts/prebid7.9.0.js?_dc=1696436849
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2

Request headers

Referer: https://heraldcourier.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 12255
content-type: text/html; charset=utf-8
date: Thu, 30 Nov 2023 16:41:02 GMT
expires: 0
last-modified: Thu, 30 Nov 2023 10:14:43 GMT
pragma: no-cache
vary: Origin

GET
H2 200 AX3dw4l-chShuz7KlUyOrqJTCrFFfFTQ1_DS3LGhDvc.js Show response
pagead2.googlesyndication.com/bg/ Frame E05E 39 KB
15 KB 22ms
9ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AX3dw4l-chShuz7KlUyOrqJTCrFFfFTQ1_DS3LGhDvc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

017dddc3897e7214a1bb3eca954c8eaea2530ab1457c54d0d7f0d2dcb1a10ef7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 13:31:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11353
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15254
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 29 Nov 2024 13:31:49 GMT

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0C8F 0
0 46ms
42ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202311280101&jk=1771547888462305&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

POST
H2 200 cookie_sync Show response
bidder.newspassid.com/ Frame B0CD 3 KB
4 KB 93ms
93ms XHR
text/plain 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/cookie_sync
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 765131d79effff73da6296d85a628e238efcdeb61b9e39426f7051b6727761d9

Request headers

Referer: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
vary: Origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://bidder.newspassid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: 0

POST
H2 200 cookie_sync Show response
bidder.newspassid.com/ Frame EEE2 3 KB
4 KB 92ms
92ms XHR
text/plain 18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.newspassid.com/cookie_sync
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459292&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: 536fd276995a2c136bf02fcab9712e38ed4fc4b94ba9e1090e9b6310085de7c6

Request headers

Referer: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459292&bidder=newspassid
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
vary: Origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://bidder.newspassid.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: 0

GET
H2

200

setuid
bidder.newspassid.com/ Frame B0CD
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BBSW_UUID%7D?gdpr=0&gdpr_consent=&us_privacy=pbs-news...
https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=d7a43f51-37ba-45e9-9c63-2de50a337b7b

0
786 B

92ms
91ms

Image
text/plain

18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=d7a43f51-37ba-45e9-9c63-2de50a337b7b
Protocol: H2
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=grid&gdpr=0&gdpr_consent=&uid=d7a43f51-37ba-45e9-9c63-2de50a337b7b
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E05E 0
10 B 7ms
7ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qSrkyQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

setuid
bidder.newspassid.com/ Frame EEE2
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=pbs-newspassid&redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=4119821668793550965332

0
763 B

92ms
92ms

Image
text/plain

18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=4119821668793550965332
Protocol: H2
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

location: https://bidder.newspassid.com/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=4119821668793550965332
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 trk.gif
jadserve.postrelease.com/ 43 B
422 B 184ms
183ms Image
image/gif 44.240.20.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_at=304&ntv_ui=4f54aca7-e074-4146-b5a7-320e5f20c574&ntv_a=AAAAAAAAAAXecRA&ntv_ht=HbtoZQA&ntv_fl=BWZZiTvTzpc2ehvfNnYVIWqFRzCyGsChK0NiWXbOHwlCmY4onTPan4hunB4tcFJ-lD0BwORe1q2_CBmpKHvgteQqkmeQRq_bsYmF6GimT8c87tfpzGdsUJZhP-26SY9voiNAQgntmeHWcrrhH1HDOQLtStzHFLL4BCJK9ruY_uPtL5VjkaoAm-FbqOP-fcFkKGsnWX75ipmVwve7RLr0PGyMnK046AnM2-Hm3_ObbXryh0qKdO8-g2DhsHvbwfIiGm1SJ6lsNizKF1ngtQWCsBZwTr4OyKwIEoy8W1oWP009sBNrQDqyfTTs1DZsFuBbhLfCMDo-RRG8YVeksM5N8GGBOb8rF5AjqGDDSVNqnx8cPiJ4dV9o51-oluXzL24k&ord=529058914&ntv_ift=1&prx_referrer=https%3A%2F%2Fheraldcourier.com%2F&ntv_it
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.240.20.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-240-20-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame B0CD 0
277 B 76ms
19ms Image
text/plain 216.52.2.86
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.86 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 30 Nov 2023 16:41:02 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2 200 cookie
cm.adform.net/ Frame EEE2 43 B
105 B 87ms
22ms Image
image/gif 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A7F8 42 B
64 B 45ms
44ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstjDTjbe49vJKRSuaROKtDr_LVuPGspEdXRduUhawtaBm1eOyDCHvsfhWw-Dcx2ELMYQZOTNiv-wjC4Wsl1YwhoIXwob4mZmRGILRnA7qTaOa9kjP0zx7R0RbyN31s0UDvdc88Cl7RsWw&sai=AMfl-YTD5gYY-jPh-9JUMe2vd1jljZfS6NfHhmo0Rpzds0toEpRisb8&sig=Cg0ArKJSzNLzABkjdyF-EAE&id=lidar2&mcvt=1004&p=1185,1316,1186,1319&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20231129&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3133586711&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701362459183&rpt=2536&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/b-e09f10f-fd9abb4c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie
cm.adform.net/ Frame B0CD 43 B
106 B 25ms
21ms Image
image/gif 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:41:02 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

200

setuid
bidder.newspassid.com/ Frame B0CD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=3827925611282904487

0
855 B

92ms
92ms

Image
text/plain

18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=3827925611282904487
Protocol: H2
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
an-x-request-uuid: 6425f490-060d-4e2d-acd8-6ecfad11f981
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://bidder.newspassid.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=&uid=3827925611282904487
x-proxy-origin: 80.255.10.199; 80.255.10.199; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 pbsync
usermatch.targeting.unrulymedia.com/ Frame 0147 0
0 395ms
388ms Document
text/plain 46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459292&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://bidder.newspassid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Thu, 30 Nov 2023 16:41:03 GMT

GET
H2 200 dcl.htm Show response
rt3054.infolinks.com/action/ 0
60 B 140ms
140ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3054.infolinks.com/action/dcl.htm?rid=dc2d673f-f851-4079-af0c-eeeb3e8a9c93&prod_t=u&sdata=6%20months&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/leeenterprises/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:03 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82e48920fd365d49-FRA
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

setuid
bidder.newspassid.com/ Frame B0CD
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=pbs-newspassid&r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dopenx%26uid%3D%24%7BUID%7D
https://bidder.newspassid.com/setuid?bidder=openx&uid=6f69e616-5704-49ea-9292-5483bee36805

0
960 B

96ms
95ms

Image
text/plain

18.204.193.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bidder.newspassid.com/setuid?bidder=openx&uid=6f69e616-5704-49ea-9292-5483bee36805
Protocol: H2
Server: 18.204.193.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-193-226.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Origin
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:02 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://bidder.newspassid.com/setuid?bidder=openx&uid=6f69e616-5704-49ea-9292-5483bee36805
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117

GET
H2 200 server_match
ad2.360yield.com/ Frame B0CD 43 B
199 B 126ms
31ms Image
image/gif 54.76.156.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad2.360yield.com/server_match?r=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dimprovedigital%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%7BPUB_USER_ID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.76.156.92 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-156-92.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bidder.newspassid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 30 Nov 2023 16:41:03 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 46ms
46ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202311280101&jk=1771547888462305&bg=!YGOlYyzNAAaGYW-ApmE7ADQBe5WfONmZrDV4aak45U8NJhCuiZjtx_6vAWDVQ0PRgEzbJsqbxBKA89mWJDGkQaNzQA28AgAAANRSAAAABGgBB5kCyT2HQyFxjWfvo1UERoYmxUfUslEacakqv96z66eChDYJmJPJrds2SRlm5holyMW7kl5O2Z42_Wcs4Nn5nuou4KlEpqWMbzCAoROoJjDPp51VKbogHsQ8pefy4cTcfb2ix6QpC2cMShFAoPTRS-60G-b-xArvLJesFITKZW5qohTZMLbgK7LKKCwBrR2nxQJRfzKzh3jqENaLiQm5z_jc04r01Ii3LsMjPqBbYHz4L5VzOQBKpM_PPgBG0zVSWFIoV3H1yZIWCCi8AYHLTq0cKipVdJPwDPmqOUx0RqhZY7oSy-5u3sungOJaFwpMR5zrNwMGvoQu5RBZZJTasZorjFvb5K1NLSZiWbr0jZiw_kOY_j-75Zbx2yhAbg_RxzZkdnyTM2K4SreSQQYs68OQG8M5qpLNTCOh2iS2h8wZ3ISG9-xMZaWxhrxf7dG8f-LeGWIvEmIh3iXzWMB4eQ2zzH3B581tKFAiPlzz554YR53X1ZZLmv4GremwjrFpbFif1qCj88JbOc0OZuOV7q4Nl290kF2kViXC4Kvua2JAdIyXKNHH9VPpAOSFVGUKWA0g2CmEAPMutLIrhjvEwUbXIQQgDBWoH0UbbH5uBGlVLxlJe86B8hXrhhyAfxKHuOhTjYyOMJyC6hOJd0_I-RI_Mv8mdexkqlH8ipET_5peT-AaKPwFlzBFBYHbdpUVudwmpZah9HmwusYz9uP5uXDWRnDxycQU9XFBiaxBb5RZ_4auOIKsgtnj0zI-jFxyp5Pi9iI2cGbQRKjG1y8yqcuin0OJiOY2J28QmpPtUlrJHJTvFmOrlA7yei57KC0wNrNQib2GnHXAAmQyj44Cp6d0fNNm3u-a6SxO8j8OnGUjz-S3Lu1ku_WugfkKd0_OJcQ_FBQoKvyNlBJKYGJvI0WtFRicGE5vExZuaQ3Ves0W_i21JSIyOhHGibJ9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://heraldcourier.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 204 pbsync
usermatch.targeting.unrulymedia.com/ Frame B38C 0
0 67ms
66ms Document
text/plain 46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=0&consent=&us_privacy=pbs-newspassid&rurl=https%3A%2F%2Fbidder.newspassid.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpbs-newspassid%26%24UID
Requested by: Host: bidder.newspassid.com
URL: https://bidder.newspassid.com/static/load-cookie.html?usp_consent=&pubcid=65698af0-cc65-4662-8556-6cffe80f7401&publisherId=NPID10000001&siteId=3500000313&cb=1701362459308&bidder=newspassid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://bidder.newspassid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Thu, 30 Nov 2023 16:41:03 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 17ms
17ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S5LKEZJN96&gtm=45je3b60v893785645z8887101457&_p=1701362457537&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1723897376.1701362458&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1701362458&sct=1&seg=0&dl=https%3A%2F%2Fheraldcourier.com%2F&dt=Bristol%20Herald%20Courier%20%7C%20Breaking%20News%20%7C%20%7C%20Read%20Bristol%2C%20VA%20and%20Virginia%20breaking%20news.%20Get%20latest%20news%2C%20events%20and%20information%20on%20Virginia%20sports%2C%20weather%2C%20entertainment%20and%20lifestyles&_s=3&tfd=8975
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5LKEZJN96&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heraldcourier.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 30 Nov 2023 16:41:05 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://heraldcourier.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

395 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

63 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.liadm.com/j	1970-01-21 02:12:02	Name: lidid Value: 0f96e857-262b-4390-8096-4c41167204fa
i.liadm.com/s	1970-01-20 17:19:14	Name: _li_ss Value: ChMKBgjdARDPFgoJCP____8HENkW
i6.liadm.com/s	1970-01-20 17:19:14	Name: _li_ss Value: CgA
heraldcourier.com/	1970-01-20 17:19:14	Name: _pbjs_userid_consent_data Value: 3524755945110770
.heraldcourier.com/	1970-01-21 01:21:38	Name: _pubcid Value: 65698af0-cc65-4662-8556-6cffe80f7401
.simpli.fi/	1970-01-21 01:23:04	Name: suid Value: 56EE9B2FA1994B1F85BFF04DE3320928
.heraldcourier.com/	1970-01-20 16:36:04	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://heraldcourier.com/%22%2C%22sref%22:%22%22%2C%22sts%22:1701362458547%2C%22slts%22:0}
.heraldcourier.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .heraldcourier.com
.heraldcourier.com/	1970-01-21 02:12:02	Name: _lc2_fpi Value: 3f389ea64a07--01hgghnqybt24tbh30hfh1cyd5
.heraldcourier.com/	1970-01-21 02:12:02	Name: _lc2_fpi_meta Value: {%22w%22:1701362458571}
.heraldcourier.com/	1970-01-21 02:05:26	Name: _parsely_visitor Value: {%22id%22:%22pid=d359c2d6-3c27-4ecb-aee6-99018b1ff677%22%2C%22session_count%22:1%2C%22last_session_ts%22:1701362458547}
.heraldcourier.com/	1970-01-21 02:12:02	Name: _ml_id Value: a31c5a8cf005d6b2.1701362459.1.1701362459.1701362459
.heraldcourier.com/	1970-01-20 16:36:04	Name: _ml_ses Value: *
.heraldcourier.com/	1970-01-20 16:36:06	Name: AMP_TOKEN Value: %24NOT_FOUND
.heraldcourier.com/	1970-01-20 16:37:28	Name: _gid Value: GA1.2.931987926.1701362459
.heraldcourier.com/	1970-01-20 16:36:02	Name: _dc_gtm_UA-54716522-7 Value: 1
.heraldcourier.com/	1970-01-20 16:36:02	Name: _dc_gtm_UA-54716522-2 Value: 1
.heraldcourier.com/	1970-01-21 01:57:38	Name: __gads Value: ID=59c0a0fc9107adc4:T=1701362458:RT=1701362458:S=ALNI_Mbg_pQP_z9ZIBCzf-fL0to-RggATA
.heraldcourier.com/	1970-01-21 01:57:38	Name: __gpi Value: UID=00000cff7853dec2:T=1701362458:RT=1701362458:S=ALNI_MY_XBvrMx5yna3nSBqpkkjbT3cumA
.openx.net/	1970-01-21 01:21:38	Name: i Value: 851b5680-471c-45f4-a3c8-5c7e5b9f9975\|1701362459
.criteo.com/	1970-01-21 01:57:38	Name: receive-cookie-deprecation Value: 1
.criteo.com/	1970-01-21 01:57:38	Name: uid Value: b0e08d16-e079-46b9-9052-738500279120
.liadm.com/	1970-01-21 02:12:02	Name: lidid Value: 0f96e857-262b-4390-8096-4c41167204fa
.heraldcourier.com/	1970-01-20 18:45:38	Name: _fbp Value: fb.1.1701362459566.1881441532
.doubleclick.net/	1970-01-21 01:57:38	Name: IDE Value: AHWqTUnrTYJz7b8yov9YwPdMeHDQHJKqKCqDw7MMXcxHM04NmlkotXOMebMkVbIluqU
.heraldcourier.com/	1970-01-21 01:21:38	Name: connectId Value: {"ttl":86400000,"lastUsed":1701362459706,"lastSynced":1701362459706}
.heraldcourier.com/	1970-01-21 02:12:02	Name: _ga_4T2EB147B8 Value: GS1.1.1701362459.1.0.1701362459.60.0.0
.heraldcourier.com/	1970-01-21 02:12:02	Name: _ga Value: GA1.1.1723897376.1701362458
.heraldcourier.com/	1970-01-21 02:12:02	Name: _ga_S5LKEZJN96 Value: GS1.1.1701362458.1.0.1701362460.58.0.0
.heraldcourier.com/	1970-01-21 01:57:38	Name: cto_bundle Value: exflDF8lMkZuYVNTTmRVbW03MGRDVTdCS1dEZHh4SDV3RWtsa3J3R2V4UEhKUlVURUxlZXltbFglMkJwMyUyRkxZenRhRFRUYjh0Y0JxMEpIUGxSa2glMkY2d3NWTFNDTWQxWUZPMlhjbXN4S1V5JTJGaWdGT2Mxc2FxYngxazNzaVRhbzRjTENEWjJTaTNaZjhURmdaRkoxJTJGJTJCWnZoMlFpT3ZJQ3UwcDYlMkZodjV4OG4xU1l2Y1IlMkZ4ZzglM0Q
.heraldcourier.com/	1970-01-21 01:21:38	Name: ajs_anonymous_id Value: 5e6068d3-70b4-44f9-8d2d-5f14fbd3d810
heraldcourier.com/	1969-12-31 23:59:59	Name: logglytrackingsession Value: 7b61e179-5335-449c-953f-dc3c365d53e6
.heraldcourier.com/	1970-01-20 17:19:14	Name: _li_ss Value: ChMKBgjdARDPFgoJCP____8HENkW
.heraldcourier.com/	1970-01-20 17:19:14	Name: _li_ss_meta Value: {%22w%22:1701362461269%2C%22e%22:1703954461269}
.infolinks.com/	1970-01-21 02:12:02	Name: cuid Value: 323a4601-a9e0-4839-bb50-31d91688b936
.postrelease.com/	1970-01-21 01:21:38	Name: opt_out Value: 1
heraldcourier.com/	1969-12-31 23:59:59	Name: ntvSession Value: {"id":1452231,"placementID":1173341,"lastInteraction":1701362461583,"sessionStart":1701362461583,"sessionEndDate":1701385200000,"experiment":""}
.simpli.fi/	1970-01-20 16:46:07	Name: uid_syncd_secure Value: true
.agkn.com/	1970-01-21 01:21:38	Name: ab Value: 0001%3ABzoX7gVji6EZja5i3XT2LjHsEdxOEsEL
.tapad.com/	1970-01-20 18:02:26	Name: TapAd_TS Value: 1701362462295
.tapad.com/	1970-01-20 18:02:26	Name: TapAd_DID Value: 718138c1-9424-48ba-bfcf-e8535bc713e3
.pro-market.net/	1970-01-20 20:55:14	Name: anProfile Value: "1ghzsrr3uwcbc+1+1f=1+1g=1+1j=41+rs=s+rt=2A0104A0005A00000000000000000010+s2=(s4y3oe)+vm=24-56EE9B2FA1994B1F85BFF04DE3320928"
.pro-market.net/	1970-01-20 17:19:14	Name: anHistory Value: "1ghzsrr3uwcbc+2+!#7')%g#ap{"
.tapad.com/	1970-01-20 18:02:26	Name: TapAd_3WAY_SYNCS Value:
.adnxs.com/	1970-01-20 18:45:38	Name: uuid2 Value: 3827925611282904487
.yahoo.com/	1970-01-21 01:22:00	Name: A3 Value: d=AQABBB67aGUCEIjcs06QZxu5rrk_1757xaAFEgEBAQEMamVyZeAYyiMA_eMAAA&S=AQAAAkiFRBLopH3lXIfrms2-Hl0
.exelator.com/	1970-01-20 19:28:50	Name: EE Value: "acf9731a0cf9c1e50e81b4692775886e"
.adnxs.com/	1970-01-20 18:45:38	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GVNh0c?m!]tbPl1N!7OnM$=BX0'jce-nfRe/_ifLYi-=K[fo(+Ke8Y=_k_>pZfCo>p`riDR/X%W#.wL4W1Qw231Q^/M
.agkn.com/	1970-01-21 01:21:38	Name: u Value: C\|0AAAAAAAALPt3ngAAAAAA
.exelator.com/	1970-01-20 19:28:50	Name: ud Value: "eJxrXxzq6XKLQSExOc3S3Ngw0QBIJxummhqkWhgmmZhZGpmbm1pYmKUuLkstWrC0tDg1JenQkoqckpym1WXxoY7xbo6%252Bnj6Ry5wzivJzU1eAhcJcgxYbGlouyS%252FKTF%252Fk4rq4KCWNYVFJ8angYwK9AJ79Kd0%253D"
.1rx.io/	1970-01-21 01:21:38	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003%22%7D
.bluekai.com/	1970-01-20 20:58:07	Name: bku Value: blx99ObfSsVhUATk
.bluekai.com/	1970-01-20 20:58:07	Name: bkpa Value: KJy9nyexd02pSUHknp/8mE1hwtkAwEDtHDD8xMJsxEW8mEHY1DRTBDJsHM96HWDp1p/ymE/T9y9gpxrh
.bidder.newspassid.com/	1970-01-20 18:45:38	Name: newspassid_uid Value: 2Yu58JDVuAuYMRqciafQdDLQoXi
.bidswitch.net/	1970-01-21 01:21:38	Name: tuuid Value: d7a43f51-37ba-45e9-9c63-2de50a337b7b
.bidswitch.net/	1970-01-21 01:21:38	Name: c Value: 1701362462
.bidswitch.net/	1970-01-21 01:21:38	Name: tuuid_lu Value: 1701362462
.3lift.com/	1970-01-20 18:45:38	Name: tluid Value: 4119821668793550965332
.bfmio.com/	1970-01-21 01:21:38	Name: __141_cid Value: 56EE9B2FA1994B1F85BFF04DE3320928
.bfmio.com/	1970-01-21 01:21:38	Name: __io_cid Value: f4126298a37f2ec7a53bdf5c2c9faf551868e97a
.targeting.unrulymedia.com/	1970-01-21 01:21:38	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-7e9d27de-bc20-4472-9052-7d1ce2572b53-003%22%7D
bidder.newspassid.com/	1970-01-20 16:46:07	Name: AWSALBTGCORS Value: JFsdDQR5kIM4txH1Yp3951lIluNyUTUdGdds55B1szWqCIAa58bNq1sONfzH1DqByxo2UDMy+5ByfB1Uojfi2IX95vY2SM7oAtv4ufOQqbV40CqM1Cbj0MV9PljuyevAaclW7e5Vcv4Ep+vwzhcrdqA/pOzOV4j/Ub4DwB+7ZfmoYTnAwt8=
.bidder.newspassid.com/	1970-01-20 18:45:38	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJhZG54cyI6eyJ1aWQiOiIzODI3OTI1NjExMjgyOTA0NDg3IiwiZXhwaXJlcyI6IjIwMjMtMTItMTRUMTY6NDE6MDIuODY2OTMwNjE3WiJ9LCJvcGVueCI6eyJ1aWQiOiI2ZjY5ZTYxNi01NzA0LTQ5ZWEtOTI5Mi01NDgzYmVlMzY4MDUiLCJleHBpcmVzIjoiMjAyMy0xMi0xNFQxNjo0MTowMy4wMTI3MTU5MDRaIn0sInRyaXBsZWxpZnQiOnsidWlkIjoiNDExOTgyMTY2ODc5MzU1MDk2NTMzMiIsImV4cGlyZXMiOiIyMDIzLTEyLTE0VDE2OjQxOjAyLjY3MDY2MjA3WiJ9fSwiYmRheSI6IjIwMjMtMTEtMzBUMTY6NDE6MDIuNjcwNjU4NzMzWiJ9

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	warning	URL: https://tagan.adlightning.com/leeenterprises/op.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=56EE9B2FA1994B1F85BFF04DE3320928 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=56EE9B2FA1994B1F85BFF04DE3320928 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://idsync.rlcdn.com/419566.gif?partner_uid=56EE9B2FA1994B1F85BFF04DE3320928 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ad.gt
a3499ea7b21d205cb90c7352bc06aff9.safeframe.googlesyndication.com
aa.agkn.com
aax.amazon-adsystem.com
ad2.360yield.com
ampcid.google.com
ampcid.google.de
ap.lijit.com
api.segment.io
b-code.liadm.com
bcp.crwdcntrl.net
bidder.newspassid.com
bloximages.chicago2.vip.townnews.com
bloximages.newyork1.vip.townnews.com
c.amazon-adsystem.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.parsely.com
cdn.prod.uidapi.com
cdn.segment.com
cdnjs.cloudflare.com
ce.lijit.com
cm.adform.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
config.aps.amazon-adsystem.com
connect.facebook.net
connectid.analytics.yahoo.com
d.agkn.com
d1eoo1tco6rr5e.cloudfront.net
dis.criteo.com
eb2.3lift.com
email.mail.heraldcourier.com
esp.rtbhouse.com
fei.pro-market.net
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
heraldcourier.com
i.liadm.com
i.simpli.fi
i6.liadm.com
ib.adnxs.com
id.hadron.ad.gt
id5-sync.com
idsync.rlcdn.com
insight.adsrvr.org
invstatic101.creativecdn.com
jadserve.postrelease.com
js.matheranalytics.com
lb.eu-1-id5-sync.com
loadm.exelator.com
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
p1.parsely.com
pagead2.googlesyndication.com
pixel.rubiconproject.com
pixel.tapad.com
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
region1.analytics.google.com
resources.infolinks.com
router.infolinks.com
rp.liadm.com
rp4.liadm.com
rt3054.infolinks.com
rtb.openx.net
s-jsonp.moatads.com
s.ad.smaato.net
s.ntv.io
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
simplifi.partners.tremorhub.com
sli.heraldcourier.com
stags.bluekai.com
static.criteo.net
stats.g.doubleclick.net
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.targeting.unrulymedia.com
tag.simpli.fi
tagan.adlightning.com
tags.crwdcntrl.net
tpc.googlesyndication.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
usermatch.targeting.unrulymedia.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.i.matheranalytics.com
x.bidswitch.net
z.moatads.com
104.16.133.24
107.178.250.234
108.138.1.25
13.227.217.72
13.32.119.77
142.250.185.226
142.250.186.130
162.19.138.119
162.19.138.83
172.66.41.9
172.66.42.247
178.250.1.9
18.198.126.47
18.204.193.226
18.238.17.128
18.239.69.3
18.65.39.76
185.89.210.180
192.104.183.109
2.16.185.46
2001:4860:4802:34::36
216.52.2.86
216.52.2.91
23.192.153.172
23.213.165.236
23.57.19.78
2600:1901:0:8eee::
2600:1f18:612b:4200:69f4:eef1:1a8c:a311
2600:1f18:730:b150:8a29:493b:1f46:72ba
2600:1f18:ed:550e:958:d678:1b00:5c96
2600:9000:2090:400:8:8845:1500:93a1
2600:9000:2090:d000:10:dd8:5e40:93a1
2600:9000:223c:5a00:d:e169:8180:93a1
2600:9000:2250:7400:a:e047:753:a221
2600:9000:25e8:7400:1b:5138:8a40:93a1
2606:4700:10::6816:34ad
2606:4700:10::6816:445
2606:4700:10::ac43:266a
2606:4700::6810:5614
2606:4700::6811:180e
2a00:1450:4001:801::2008
2a00:1450:4001:80b::2001
2a00:1450:4001:812::2003
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a00:1450:400c:c0b::9b
2a02:2638:3::3
2a02:2638:3::c
2a02:26f0:480:23::1726:62ac
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
3.123.68.216
3.227.126.241
3.33.220.150
3.65.68.8
3.69.41.2
3.75.62.37
34.102.146.192
34.111.113.62
34.120.107.143
34.255.67.121
34.96.70.87
35.190.39.111
35.204.74.118
35.204.89.238
35.227.252.103
35.244.159.8
35.244.174.68
37.157.6.232
44.215.169.187
44.240.20.156
46.228.174.117
52.17.99.225
52.70.186.203
54.175.178.6
54.69.251.6
54.76.156.92
54.82.88.241
65.9.66.104
69.173.144.138
76.223.111.18
99.86.4.128
99.86.8.175
017dddc3897e7214a1bb3eca954c8eaea2530ab1457c54d0d7f0d2dcb1a10ef7
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
076f281a9257ad662f34badb12393195fdca0dc2fde9acd1f1628b9674a96aee
08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121
0a2877d35b782162338bb95faedfa08559e23788db9d926e97da4d0efd2dbfc5
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0cb861cd799b7c0271ff8b227ca1f54d8e0e096558573386ca3e9e70f31c1bd2
0e3fddc66d879f16be5d2a391945eeeba4ffce21cc3d7b6547019061751aec25
0ebf99d19e2297df9e5271ff4a224f78a15b460a11d62e022917f85cdca5beae
101184683ffdeec2ca9f83c6f7416fceec9b7b7e9cda1957125aef24dd4179d8
1186699d4cc78d7acd98f87883b1434fa96f46c29aafba60659b1f97814fd3d7
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
13c3d75c44519f376598514c25b7bc0d5c7a0a913f099325baad6dadaeec7d69
15b9c35d100fe81ed916760c37d124dec8b0a81d6cd737b0020652b6d5015e15
1794ab1a330fa566f4f21116012908a58001e21fb254959ac7cbcd41b25bba34
188b3c1d052fc9ee9abfde7e1ef2535cd46bfc2059c36af092b9b15753d7449d
1a77010a20c4a6611c4230df5afe003914255a35909daabaaa5a8f0427c73eec
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
1c054398e126946f73da870c3417acce050f5c796ecc3878b64cd64d723557e3
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
202b65f7735476b526548db88f43f49a959907ed4078132204f0cb1c4503f9e2
2365cc11ef3d43f265b848c7164e5487c7a49d6af06c2938ac9272c8d91fc1a2
264b5d8b72d86e7fff1d7bb6b78ea34d60ae3d95d3188956c99def00d2bfaa5a
27dcbcdf1f083c39f9a1e995559b5ee5b2c3bb4574dd87c09e7024175ebea1b3
2823072c1024e9a1991e9c1169a07eccf9ee235b27d76ed11a8a78f8ece5f82f
296ffff5be5fa17a541df8e925d24e473ced64d535f543542bebc15759b761fd
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f7c228db76f66cd6b7657b99fb3a177d40b1ffd1cc3aa3013f746a55fae0993
2fab007bf0e62a9458be4c17ddc938c6ca5e2338a7ff316652a42e69104175f7
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32209e964449881b7f2a21086506deccc49063673c2cfff6288598f843fc81c4
3412bd2510a0f987cafbe82fed002c0c0cadfc6d66ce0a594eaa62bad4a60714
3568ea19f66339e3b9a87af24fec75d33a3c6aca980c6d1e859e60afad81356f
389a36037c6d075103bfbba79fbe57d145c3203dc98e51f1f929408ae2155834
3b6854831be14d28fdfdb1758ebebe2893bf8e5be5f176b8d3e1b1b0f874d90e
3c01c1e199879f8b72679cc4d402684ba9e88c21b633547adbae6ba03a617fdc
3dbe47d0e8f6fb7905ae043b478f8d242c5ae631e9bb1ad8d0299bf35bd7e331
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ee55d11fd7f62072a2ff737ff77dabd10935e2c1be5582e6a7ebe8748c9504a
3f7d4fce911e0a58ed4224b9f65d90a98d8bb7b76d25ad2610485b9baaa1d447
41178cf09bd0bd00132c58f2597f8d249d92fbeab38bcbbdc5c8e0b7f810a3fd
4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3
4269539026c67a7e14f5d6ae39aa2fbfba7a17ab17b1cf2a95b4cf0ef7a1e59a
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45782508a28c1f03ebbfd53a3f172c85e77877a18b612b6dd23819cdc35dc54f
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4a31894ecca45b8d1c2a155ceca79ba3acbb405e81e179d6949bd75d6e54dd55
4b093bf8fe11ce768e5543697030a064da71b347431594daf7efb86f94a201c0
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b9d00cdddea53b43ce092a8545d5527689379561d18d6f925355562ab2f359e
4c0867ff49805574426a7a89e712807767fa9b2452c526736947e2b897a080ad
4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f
4dc723b7dd6602e39eb50fa74c7df276cb468805f5fae7450b00b8a568973a09
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f3170e6847314e4c12859f96c520b733b853d80c97744b0e27775744cc4c591
4f89185a0930e1e12fc54b268c6bcf84bf2b1161065dcb3ee89f6bc78b937d60
532c6209f79961f1dc5b3d368d218cd2cd1c82f059b2c79bf1b4ab5e79ed4b92
536fd276995a2c136bf02fcab9712e38ed4fc4b94ba9e1090e9b6310085de7c6
543794f3bcbf9a65ede077b769e3ec28172464917a91d6670f42f6664c4ca0d7
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54eacec863498628814d62c486eca8cd1c580c77a4dda865b5941006e40c6e66
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57f295553fdda2a7f1ee0e5dab92d82f2bace1df0a781117dee1cb06eacbf891
5cb9ec628a3a88428ab0dd29413e716c930932b4175133aaaf33a9a69d6332da
5d5575dee7e4b9fe4369c3f7de0e25337d15e0d0f045eaf41556e7eb35fcdb63
5ed99a17599d95ef5b866d328c1e0e501bc0e38f24d334f6b942b20b47565380
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64d2ce701b1f0b1d910bff7f252ae7a53d5f90cf3efb970163811c757b889d57
69216f9d036fedc356b18f77c1124b104cbe8f53d7260abb2d0e3ab0ab9a4db6
6b1660dd464d92df64233234b29c58d080cb44d4f867d9ae61b0023cb958687b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b96eb73da5fe3c20e4507bf752917f6d7978be8881c1dea934db282b028407d
6cbf86ba207b9b7808110776768d951b4faa4ee245fb03264b95978e10e96a10
6ea62c199514d68eed527ea54f5297b51d299636f30e91bc13606309488697ce
727e0151b25251f2298485fa57b50b0efe132c6ba1636cd25926fdc7035cbd30
72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc
7310e401efd5214d7c4baf2a6df94becd6d945da0682fbc3a93274eadc68e8c2
73728b044c01556d3957c4c1bcd704f74e28707d80e593490e5bc76bf4619ea2
7571db16348512fc55b35102ce3699733cf0882f4b4fb3e652fa8db700c07fb5
76460f1cd530a92dcb3d35468233b10d40dcb0ea7595aceb225104e63c3b78bc
765131d79effff73da6296d85a628e238efcdeb61b9e39426f7051b6727761d9
7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59
772cc7306c10ad8e57e2303315aa784c2a10b4eec8b3c4f84cfcb0b3859699b8
77b109dd53ec2921d47af5eedcf39cbea8bc92bf8b59a970aa104c5ed2d5b3c0
7976a9dfe57f9ba6972420500782258da674fcc523c2def08bb6a84ce275c4b5
7b1a1dbd0f5fe7429be8f57f4f18a80d428a03fe89f822c01ef9d56d3dc085c1
7dd00f2a03b96cd5ff6072e11918eb5f555c99125f0a84d7dac2391a8a32dc63
7e071e5b39d13cef80f7a46d854de133fd73c15d1351ebcf7e1f1b48821e7aeb
7e4fde2a7e2da4eb11065a29f03b7f68566665515cf79bf4841168b46508dda5
83190dc55cd275fc551670c9401e931e2ac13cbf067c4d6656f7ba0cf9d51c9b
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
851aab34e9b9e9c6252ed4a0bd57b30a79795aacdc7e036d7e824ed9e69b2807
86660ef44d06ab8ca08059da26d814a85c5429eedd7c5f48c88bfcced3525fd8
8834f8e188c21ece20d6c8a0b3b5de7cacc06d7a41f8b7768b28a59df09fefdf
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09
8e683a0ae8fc37aeae8fd20643faef0341fe5cf01c30f25f41d6bad28b1a8365
8e69c64655718315422d63e22bc7dddaacd2fe1e1ceb20a6758287a76b9c6f66
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
92e36389c6a82d00501f3b1f1ab31e4ba4b733ce714a4c6f4b69e8f5969d174d
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93eac8b1fb14d0863561633dfdf563013c023393aabfb122e3be7256629d9235
9453c81287d37b52d6364987b4fe7618de7f9761f3d6805432132efa7d5d2c60
96a87724858479a0639f7ffb5b65d0a080eb5cc66fec21e0d7d45201902fce79
96bed4c8966020005f3394a56c5c3640550a16fb324eb04c328f1b9ee8a8bc48
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9a04d3aa7560e4ce461a5f68a1fcd23cc5dbecb0aa06f1fefaa7c65e156a8197
9fd343a79407da4497fb0204a7d55f36d943d8848dbb34c737190db294bb7b85
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9
a25dae516a0e3d73697c143d2c3fe12bc67e2e088e2dfddf9a95bcb9d108667a
a2abf60298591077c6d5b81d97380295dd942ef36095adf4de1ee06f90077545
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a7bd716b2e392ee5cb7d08e74045b0b7505c3f1a3fb0594e0410671a33e36657
aa4391f03da55de95caebed478d3e1183fb01a3e8f1c5891a48e75717ed2bed9
ab37f0162374a31204d5f9b472406caf196aee2f662f8ec741bc063bbd22ca20
adfa39b53589a91e67b4d82766750bee32371b51438f41dfbd6da0764719370e
aebcff89e622223af0c9eb0c090d0914bb4ade8d93ad16873ac3f0ba4a6ef134
afe650a677c77efbe244a6c5e688fa243c81e32325e2ded497986b90c8105b2a
b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154
b10a075758097bb0578287af03c76a9fcd82fa4607587109ae41fe2d24756600
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b67ef5fd016f32a0a44093ba8544ff75d22f4d0cec5f0a8b77602d8519b472b9
b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83
b93740066fadbde00a03ff560765bd25b8e9ca74f7774a4633f61ce44b332991
bad3f4a20b737202b4cb52ce0124a2ae5d54be0002feb42790867ee446425332
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bf8a676a7f02c526c2946d58540257c34ef4a32ccd46787e08a031073b4ff642
c2008966819bb51e24bb6cbf82ef28efeb4d678e20c3b61fc02bb5d45b45e74e
c4212eef2876eb083a172b80c748943d9bc27361dfbc8268aa6ee786eee71c5b
c5c357a5e69089e5088279fc5aaa5663d088815b3408a005dd6bc93b50bf7745
c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca9bcf3ddc23ac49985ff8e9c25034e354741f54331064120f2cf7294e0e7dcf
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cab29d30666c18a6b431d25c7d278a299bdb3d7b87c81400a813beb3b5d286e4
cb741d04c2e816bab14a490a49da34c71acabb019410e0e07de44aa8ba64996a
cc3a41863d92b22799ff23c52e2173e80b13ebc75b9144151ea105cd52b59de5
cf3e21aad61783d6e6908e5631c43656c05a34a9c7f64eab44dcd7fc58562aa8
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d3947f2cdf1945e39038ab0490fe6752575d6e92c4a9facee108ddad21b00785
d43cfd0265fea9e55f9e4ce7557b1f249746d2685a4da2f72580779dfa7d5e39
d50881e8cf2ac03741c7c31b98dcabdf91d458ed76766efc511b26a2b796dd0f
d6ed3999a36ff91e0a758d067567be5a0ea2a15205257bab695728485e83e488
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
dae66852e0a17c8a1bb1050b6e3c4f2c10e3aff0d390a59f4ae26a481ca53a9b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd6a943e7ae98e23609590112a987c50e2ca6a3b4c32a32039d7c5327759d990
ddd1991e3d8ce67431989f8cca95743706d110f064ed2b3609041a3f20e50d2c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e11d0def4d95110dcdad915b0f8776ca43150f0b1bda9b09715f738d49bad7ae
e208efd3bc7196c5db30d0bf795cfb8513849fded1049006dce387cb818ebfc9
e31c42447e764b1195ff393437950867800ce2465dd3724c95640f4f5b34487c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e75ec9da1ddef1adb9dcebaf0df2ebeb0dd88c924bc051d4e555f7e32fab3c17
e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2
e88bc41dfc3e11b318a5a3eeeb403b70f98705db64962f4647a3ad2cb9083aa6
eec1d339b9dac9ef9991e418a6fd71c2cf953d77ed1597ed68f82fcc12bf7767
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4f52d2893a7da88ee0656f797c61fa2a93e47caa8f4321a5bdd907a0faf7476
f5e55a21dfa3a20ceb298737c8f4c517a83d7960468c7f53b3f33c567bacff3c
f65079c7844584bf156ebb99949a883280f65cc817eab327c170d766c2a4fa5f
f70acf7447c35e77bb255248c4f9bdb9566bf67236b8026fc0683eb8382fd4e6
f98e8196d88bff2a006872a05d79c2d695f6dda36e0aecdd0ace020207809f40
fd2c680964b28dc283f3518e21720cd2f886e7bdb8d2f5b47809ef836c337d52

heraldcourier.com Open in urlscan Pro 192.104.183.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

244 Requests

88 %HTTPS

37 %IPv6

64 Domains

101 Subdomains

81 IPs

9 Countries

3120 kBTransfer

8987 kBSize

63 Cookies

12 Outgoing links

Page URL History

Redirected requests

244 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

heraldcourier.com Open in urlscan Pro
192.104.183.109 Public Scan

Screenshot
Live screenshot

Full Image

244
Requests

88 %
HTTPS

37 %
IPv6

64
Domains

101
Subdomains

81
IPs

9
Countries

3120 kB
Transfer

8987 kB
Size

63
Cookies

244 HTTP transactions
4 data transactions