go.behindthemarkets.com Open in urlscan Pro
35.202.21.90 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.marketbeat.com/scripts/redirect.aspx?SponsorshipID=76016&UserID=12559537&interstitial=1
Effective URL:
https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_camp...
Submission: On March 05 via api (March 5th 2024, 3:54:04 am UTC) from BE — Scanned from DE

Summary HTTP 144 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 51 IPs in 10 countries across 47 domains to perform 144 HTTP transactions. The main IP is 35.202.21.90, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is go.behindthemarkets.com.
TLS certificate: Issued by R3 on January 25th 2024. Valid for: 3 months.

This is the only time go.behindthemarkets.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:310... 2606:4700:3108::ac42:2b0e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	35.202.21.90 35.202.21.90	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	34.107.203.240 34.107.203.240	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
58	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:38::15	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
6	35.192.151.63 35.192.151.63	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
7	2a02:2638:3::e 2a02:2638:3::e	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c02::9c	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
3 5	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
3 6	2606:4700::68... 2606:4700::6810:7aaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	35.214.149.91 35.214.149.91	15169 (GOOGLE) (GOOGLE)
2 3	185.89.210.141 185.89.210.141	29990 (ASN-APPNEX) (ASN-APPNEX)
1	95.101.148.20 95.101.148.20	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	81.17.55.116 81.17.55.116	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
3	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1	2.19.85.30 2.19.85.30	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	2.21.22.153 2.21.22.153	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	37.157.3.20 37.157.3.20	198622 (ADFORM) (ADFORM)
1	185.255.84.153 185.255.84.153	200271 (IGUANE-) (IGUANE-)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.251.106.238 34.251.106.238	16509 (AMAZON-02) (AMAZON-02)
1	141.95.33.120 141.95.33.120	16276 (OVH) (OVH)
1	54.73.231.133 54.73.231.133	16509 (AMAZON-02) (AMAZON-02)
1	34.117.157.22 34.117.157.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	52.58.90.171 52.58.90.171	16509 (AMAZON-02) (AMAZON-02)
1	63.32.163.40 63.32.163.40	16509 (AMAZON-02) (AMAZON-02)
1	64.202.112.31 64.202.112.31	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	185.64.191.210 185.64.191.210	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	3.122.11.77 3.122.11.77	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4200:b1c9:bbe6:9d18:57f1	14618 (AMAZON-AES) (AMAZON-AES)
1	85.215.5.31 85.215.5.31	6786 (CRONON-BE...) (CRONON-BERLIN-AS)
1	23.32.185.192 23.32.185.192	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.210.94.187 52.210.94.187	16509 (AMAZON-02) (AMAZON-02)
1	52.28.138.244 52.28.138.244	16509 (AMAZON-02) (AMAZON-02)
1	52.19.180.99 52.19.180.99	16509 (AMAZON-02) (AMAZON-02)
144	51

1 2606:4700:3108::ac42:2b0e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.marketbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.behindthemarkets-btm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.202.21.90 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 90.21.202.35.bc.googleusercontent.com

go.behindthemarkets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
btm-btm-btm.lpages.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.107.203.240 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 240.203.107.34.bc.googleusercontent.com

static.leadpages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
embed.lpcontent.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

58 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh3.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:38::15 (United States)

ASN15169 (GOOGLE, US)

js.center.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.192.151.63 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 63.151.192.35.bc.googleusercontent.com

api.leadpages.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638:3::e (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dynamic.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c02::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.az	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:2638:3::c (France) 3 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.9 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

sslwidget.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

widget.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:7aaf (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.149.91 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 91.149.214.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.141 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.148.20 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a95-101-148-20.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.17.55.116 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync-t1.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.85.30 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-85-30.deploy.static.akamaitechnologies.com

criteo-sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.22.153 (Glattbrugg, Switzerland)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-22-153.deploy.static.akamaitechnologies.com

hb.yahoo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.3.20 (Denmark)

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.255.84.153 (France)

ASN200271 (IGUANE-, FR)

visitor.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.251.106.238 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-106-238.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.33.120 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203256.ip-141-95-33.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.73.231.133 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-231-133.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.157.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.157.117.34.bc.googleusercontent.com

matching.ivitrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.90.171 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-90-171.eu-central-1.compute.amazonaws.com

exchange.mediavine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.163.40 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-163-40.eu-west-1.compute.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.31 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.191.210 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.122.11.77 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-11-77.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:b1c9:bbe6:9d18:57f1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

criteo-partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.215.5.31 (Germany)

ASN6786 (CRONON-BERLIN-AS, DE)

a.twiago.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.32.185.192 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-32-185-192.deploy.static.akamaitechnologies.com

ad.yieldlab.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.94.187 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-94-187.eu-west-1.compute.amazonaws.com

sync-criteo.ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.138.244 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-138-244.eu-central-1.compute.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.180.99 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-180-99.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	googleusercontent.com lh3.googleusercontent.com — Cisco Umbrella Rank: 46	291 KB
15	criteo.com 4 redirects dynamic.criteo.com — Cisco Umbrella Rank: 3991 gum.criteo.com — Cisco Umbrella Rank: 466 mug.criteo.com — Cisco Umbrella Rank: 3065 sslwidget.criteo.com — Cisco Umbrella Rank: 2410 widget.us.criteo.com — Cisco Umbrella Rank: 21338 dis.criteo.com — Cisco Umbrella Rank: 662	157 KB
6	unpkg.com 3 redirects unpkg.com — Cisco Umbrella Rank: 709	16 KB
6	leadpages.io api.leadpages.io — Cisco Umbrella Rank: 41221	3 KB
5	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 stats.g.doubleclick.net — Cisco Umbrella Rank: 84 cm.g.doubleclick.net — Cisco Umbrella Rank: 271	4 KB
5	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1148 trc.taboola.com — Cisco Umbrella Rank: 683 sync-t1.taboola.com — Cisco Umbrella Rank: 1739 trc-events.taboola.com — Cisco Umbrella Rank: 2341	24 KB
4	google.az www.google.az — Cisco Umbrella Rank: 37703	733 B
4	google.com analytics.google.com — Cisco Umbrella Rank: 148 www.google.com — Cisco Umbrella Rank: 2	929 B
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	360 KB
4	center.io js.center.io — Cisco Umbrella Rank: 48124	15 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 256	3 KB
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 246	1 KB
2	casalemedia.com 1 redirects r.casalemedia.com — Cisco Umbrella Rank: 1838	1 KB
2	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2330	3 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29	21 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	3 KB
2	leadpages.net static.leadpages.net — Cisco Umbrella Rank: 47024	53 KB
2	behindthemarkets-btm.com 1 redirects www.behindthemarkets-btm.com	20 KB
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 1089	44 B
1	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 2357	44 B
1	yieldmo.com sync-criteo.ads.yieldmo.com — Cisco Umbrella Rank: 3152	38 B
1	yieldlab.net ad.yieldlab.net — Cisco Umbrella Rank: 4638	235 B
1	twiago.com a.twiago.com — Cisco Umbrella Rank: 34763	153 B
1	tremorhub.com criteo-partners.tremorhub.com — Cisco Umbrella Rank: 2971	398 B
1	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 523	35 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 951	225 B
1	outbrain.com sync.outbrain.com — Cisco Umbrella Rank: 873	218 B
1	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 1163	423 B
1	mediavine.com exchange.mediavine.com — Cisco Umbrella Rank: 1463	880 B
1	ivitrack.com matching.ivitrack.com — Cisco Umbrella Rank: 10260	265 B
1	360yield.com ad.360yield.com — Cisco Umbrella Rank: 724	199 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 433	1 KB
1	omnitagjs.com visitor.omnitagjs.com — Cisco Umbrella Rank: 737	342 B
1	adform.net cm.adform.net — Cisco Umbrella Rank: 1161	163 B
1	yahoo.net hb.yahoo.net — Cisco Umbrella Rank: 692	315 B
1	3lift.com eb2.3lift.com — Cisco Umbrella Rank: 426	140 B
1	teads.tv criteo-sync.teads.tv — Cisco Umbrella Rank: 2809	163 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 687	163 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 388	239 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 759	809 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 383	235 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 228	11 KB
1	lpages.co btm-btm-btm.lpages.co	19 KB
1	lpcontent.net embed.lpcontent.net — Cisco Umbrella Rank: 57739	15 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	behindthemarkets.com go.behindthemarkets.com	68 KB
1	marketbeat.com 1 redirects www.marketbeat.com — Cisco Umbrella Rank: 81315	328 B
144	47

	Domain	Requested by
58	lh3.googleusercontent.com	go.behindthemarkets.com btm-btm-btm.lpages.co
7	dynamic.criteo.com	www.googletagmanager.com
6	unpkg.com	3 redirects btm-btm-btm.lpages.co
6	api.leadpages.io	js.center.io embed.lpcontent.net
4	gum.criteo.com	3 redirects dynamic.criteo.com
4	www.google.az	go.behindthemarkets.com
4	www.googletagmanager.com	go.behindthemarkets.com www.googletagmanager.com
4	js.center.io	go.behindthemarkets.com js.center.io btm-btm-btm.lpages.co
3	ib.adnxs.com	2 redirects
3	www.google.com	go.behindthemarkets.com
2	trc-events.taboola.com	cdn.taboola.com
2	dpm.demdex.net	1 redirects
2	r.casalemedia.com	1 redirects
2	script.crazyegg.com	btm-btm-btm.lpages.co script.crazyegg.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.googleapis.com	go.behindthemarkets.com btm-btm-btm.lpages.co
2	static.leadpages.net	go.behindthemarkets.com btm-btm-btm.lpages.co
2	www.behindthemarkets-btm.com	1 redirects go.behindthemarkets.com
1	beacon.krxd.net
1	e1.emxdgt.com
1	sync-criteo.ads.yieldmo.com
1	ad.yieldlab.net
1	a.twiago.com
1	criteo-partners.tremorhub.com
1	match.sharethrough.com
1	simage2.pubmatic.com
1	sync.outbrain.com
1	jadserve.postrelease.com
1	exchange.mediavine.com
1	matching.ivitrack.com
1	ad.360yield.com
1	id5-sync.com
1	visitor.omnitagjs.com
1	cm.adform.net
1	hb.yahoo.net
1	eb2.3lift.com
1	criteo-sync.teads.tv
1	sync-t1.taboola.com
1	rtb-csync.smartadserver.com
1	pixel.rubiconproject.com
1	contextual.media.net
1	dis.criteo.com
1	x.bidswitch.net
1	cm.g.doubleclick.net
1	cdnjs.cloudflare.com	btm-btm-btm.lpages.co
1	widget.us.criteo.com	go.behindthemarkets.com
1	sslwidget.criteo.com	1 redirects
1	mug.criteo.com	go.behindthemarkets.com
1	trc.taboola.com	cdn.taboola.com
1	analytics.google.com	www.googletagmanager.com
1	btm-btm-btm.lpages.co	embed.lpcontent.net
1	cdn.taboola.com	www.googletagmanager.com
1	embed.lpcontent.net	go.behindthemarkets.com
1	fonts.gstatic.com	fonts.googleapis.com
1	go.behindthemarkets.com
1	www.marketbeat.com	1 redirects
144	58

This site contains links to these domains. Also see Links.

Domain
behindthemarkets.com

Subject Issuer	Validity	Valid
go.behindthemarkets.com R3	`2024-01-25` - `2024-04-24`	3 months	crt.sh
static.leadpages.net GTS CA 1D4	`2024-02-10` - `2024-05-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
js.center.io GTS CA 1D4	`2024-03-01` - `2024-05-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
behindthemarkets-btm.com E1	`2024-02-26` - `2024-05-26`	3 months	crt.sh
embed.lpcontent.net GTS CA 1D4	`2024-01-28` - `2024-04-27`	3 months	crt.sh
*.leadpages.io R3	`2024-02-21` - `2024-05-21`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-08` - `2024-05-07`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
*.lpages.co R3	`2024-02-21` - `2024-05-21`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.az GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
script.crazyegg.com E1	`2024-02-06` - `2024-05-06`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-21` - `2024-12-21`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.smartadserver.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-01-17` - `2025-01-16`	a year	crt.sh
teads.tv R3	`2024-01-22` - `2024-04-21`	3 months	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
hb.yahoo.net R3	`2024-03-02` - `2024-05-31`	3 months	crt.sh
*.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-25` - `2024-06-18`	a year	crt.sh
omnitagjs.com Sectigo RSA Domain Validation Secure Server CA	`2023-06-23` - `2024-07-22`	a year	crt.sh
*.id5-sync.com R3	`2024-03-01` - `2024-05-30`	3 months	crt.sh
*.360yield.com Amazon RSA 2048 M01	`2023-05-29` - `2024-06-26`	a year	crt.sh
itm.ivitrack.com R3	`2024-02-12` - `2024-05-12`	3 months	crt.sh
exchange.mediavine.com Amazon RSA 2048 M02	`2023-06-06` - `2024-07-04`	a year	crt.sh
*.postrelease.com Amazon RSA 2048 M02	`2023-12-19` - `2025-01-16`	a year	crt.sh
*.outbrain.com Thawte TLS RSA CA G1	`2023-11-20` - `2024-11-27`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2023-04-20` - `2024-05-20`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
*.tremorhub.com Amazon RSA 2048 M03	`2024-01-24` - `2025-02-21`	a year	crt.sh
*.twiago.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-07` - `2025-01-06`	a year	crt.sh
*.yieldlab.net DigiCert TLS RSA SHA256 2020 CA1	`2023-09-17` - `2024-09-17`	a year	crt.sh
*.ads.yieldmo.com Amazon RSA 2048 M03	`2024-03-04` - `2025-04-03`	a year	crt.sh
*.emxdgt.com Amazon RSA 2048 M01	`2023-05-03` - `2024-05-31`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
Frame ID: 964297C7085C63F04CD7AFA14845A507
Requests: 99 HTTP requests in this frame

Frame: https://js.center.io/identify.html
Frame ID: B6E4AB1687A67350081CD3443C776B4F
Requests: 1 HTTP requests in this frame

Frame: https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96
Frame ID: 2359D40373AEBB6325C45329457A92DC
Requests: 12 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=go.behindthemarkets.com&origin=onetag
Frame ID: 17E8430FF94422D5424F81FB9879D6E4
Requests: 2 HTTP requests in this frame

Frame: https://js.center.io/identify.html
Frame ID: 6A4069C4B24AA5767DBB4721336EBBFC
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-FWLCi4-fFf72OFWPyweTCe53u4LTQZ3mPhnW1A&google_cm&google_hm=ay1GV0xDaTQtZkZmNzJPRldQeXdlVENlNTN1NExUUVozbVBoblcxQQ
Frame ID: 03B0B6A8782BC5A4E1C79D3DF8EDB504
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

"Cut & Paste"

Page URL History Show full URLs

https://www.marketbeat.com/scripts/redirect.aspx?SponsorshipID=76016&UserID=12559537&interstitial=1 HTTP 301
https://www.behindthemarkets-btm.com/5C1XW5/2CTPL/?creative_id=529&sub5=n76016&source_id=mbu12559537&sub4=StoryLink HTTP 302
https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&ut... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

144
Requests

94 %
HTTPS

37 %
IPv6

47
Domains

58
Subdomains

51
IPs

10
Countries

1106 kB
Transfer

3049 kB
Size

33
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://behindthemarkets.com/p/terms
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://behindthemarkets.com/p/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.marketbeat.com/scripts/redirect.aspx?SponsorshipID=76016&UserID=12559537&interstitial=1 HTTP 301
https://www.behindthemarkets-btm.com/5C1XW5/2CTPL/?creative_id=529&sub5=n76016&source_id=mbu12559537&sub4=StoryLink HTTP 302
https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://gum.criteo.com/sid/json?origin=onetag&domain=behindthemarkets.com&sn=ChromeSyncframe&so=0&topUrl=go.behindthemarkets.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=JgZt2nxVeWxQSnY3NEZGVUJmQjJpWHA0S0Znek5ONDNKWURMajlMRWpsSUpaUEN1WS9ENkZVOTFZV1FPK29VVjR2Y1haMk1zY3MzcWxwbmExSkRVdDRmU1JKNXVLS2NieTYzeGE0bGRrRldjajd6aDAveEdmVlAxRlJRSjU1d3JFeS85RGRxdVlzcDV5VEZPUm9RMng4M2RHYTRRc2tUR2hXaFpaMTQrTEMzRlFiQnFvVWJXS3AwWm5rcytrYWlWVC9RZ2VvSW1UVEd6N3V5NTE0L1ZIbnZzZHlFMElRbnJaNDVEQWJ2ek1JRzYzNk9OaWoyUnQxNVNNcXN2cEkyN2laaWc1VHdvendpbmVXQkJLdks4UElyU25HWkl4T1BaaVBQNUl6UlFWVmVVMHdMST18&cppv=2

Request Chain 96

https://sslwidget.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFRZHpNMFNVc3VwREtEQUhMZk8xSkRiekZTZlBxZTBYd252UlJPZWpBcnFJMGpxRFFMTXFHdzRUMiUyQnNaT2RZSmpybE1GYnElMkJjZkM2WGMyOXNtNGRKZEdNOHU2dFl4YWZtWHRGVFVMR1NRM1NGZ0czcTVtN2RjODdPNUg2d2UlMkZSME44dCUyQkpOZyUyRnBORnM4JTNE&tld=behindthemarkets.com&dy=1&fu=https%253A%252F%252Fgo.behindthemarkets.com%252Flimited-time-offer-4%252F%253F_ef_transaction_id%253Dc23aa525a8ea48c493cb0d529d299ad7%2526utm_source%253D96%2526utm_campaign%253D529%2526utm_medium%253Dmbu12559537%2526id%253D%2526iocid%253D%2526oid%253D1%2526aff%253D96&ceid=644851f4-c07c-469f-be39-15e29452bbbb&dtycbr=44123 HTTP 302
https://widget.us.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFRZHpNMFNVc3VwREtEQUhMZk8xSkRiekZTZlBxZTBYd252UlJPZWpBcnFJMGpxRFFMTXFHdzRUMiUyQnNaT2RZSmpybE1GYnElMkJjZkM2WGMyOXNtNGRKZEdNOHU2dFl4YWZtWHRGVFVMR1NRM1NGZ0czcTVtN2RjODdPNUg2d2UlMkZSME44dCUyQkpOZyUyRnBORnM4JTNE&tld=behindthemarkets.com&dy=1&fu=https%253A%252F%252Fgo.behindthemarkets.com%252Flimited-time-offer-4%252F%253F_ef_transaction_id%253Dc23aa525a8ea48c493cb0d529d299ad7%2526utm_source%253D96%2526utm_campaign%253D529%2526utm_medium%253Dmbu12559537%2526id%253D%2526iocid%253D%2526oid%253D1%2526aff%253D96&ceid=644851f4-c07c-469f-be39-15e29452bbbb&dtycbr=44123

Request Chain 99

https://unpkg.com/spectre.css/dist/spectre.min.css HTTP 302
https://unpkg.com/spectre.css@0.5.9/dist/spectre.min.css

Request Chain 100

https://unpkg.com/spectre.css/dist/spectre-exp.min.css HTTP 302
https://unpkg.com/spectre.css@0.5.9/dist/spectre-exp.min.css

Request Chain 101

https://unpkg.com/spectre.css/dist/spectre-icons.min.css HTTP 302
https://unpkg.com/spectre.css@0.5.9/dist/spectre-icons.min.css

Request Chain 110

https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6215474940901846295

Request Chain 120

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA HTTP 302
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA&C=1

Request Chain 121

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv

Request Chain 137

https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=eVii9OBrltGK9OCyohrVQVstYy48_5V-

144 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
go.behindthemarkets.com/limited-time-offer-4/
Redirect Chain

https://www.marketbeat.com/scripts/redirect.aspx?SponsorshipID=76016&UserID=12559537&interstitial=1
https://www.behindthemarkets-btm.com/5C1XW5/2CTPL/?creative_id=529&sub5=n76016&source_id=mbu12559537&sub4=StoryLink
https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96

604 KB
68 KB

592ms
259ms

Document
text/html

35.202.21.90
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.202.21.90 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

90.21.202.35.bc.googleusercontent.com

Software

Leadpages /

Resource Hash

4348386f343aee8601f19bee98d6dc95b399d554fc5469fb07f2b88b1ed8ed39

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache
content-encoding: br
content-type: text/html
date: Tue, 05 Mar 2024 03:53:58 GMT
etag: W/"4bf971e6138ab8b6ff9a5fa135c4c27b"
last-modified: Fri, 01 Mar 2024 14:56:43 GMT
server: Leadpages
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: MISS, HIT

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f7297b6f771d94-FRA
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 03:53:58 GMT
location: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KBJ%2B2mmiaq7gQVPq2o08bx6X4EG6ClpSbkhekbxLdP86sdNH9ST8S1SAU1JctKumnQ4BcmyCTQNNf9h5kp8b1kZkpjSTGF9LPNUz%2BWz%2FbVPKrsMTJL%2B4qD93uPMI%2BbGDeyGWtnlwtG6UFINnBkwE%2FMvIZjH%2FIIe7uzJa"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
via: 1.1 google
x-eflow-request-id: 555c5045-6ced-4c87-88c1-2685659a990c

GET
H2 200 all.min.css
static.leadpages.net/fonts/font-awesome/6.4.2/css/ 100 KB
26 KB 92ms
25ms Stylesheet
text/css 34.107.203.240
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.leadpages.net/fonts/font-awesome/6.4.2/css/all.min.css
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.240 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 240.203.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Fri, 01 Mar 2024 11:24:31 GMT
content-encoding: gzip
via: 1.1 google
server: Google Frontend
age: 318568
etag: "EqK-AA"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-cloud-trace-context: fa5ba0bf92c9944a8d4063822e577d8f
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26836
expires: Sat, 01 Mar 2025 11:24:31 GMT

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 84ms
32ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700

Requested by

Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 02:56:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2 200 T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w16
lh3.googleusercontent.com/ 427 B
521 B 92ms
34ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c73db4ca5a6cf322e5295cea84c2f0cdecb812b1d7998d57bb6528684600e62f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 427
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w16
lh3.googleusercontent.com/ 438 B
735 B 90ms
32ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

802b0e03789d326a08c22fef2dffdffb8d7691e13f410e7d1d6ce72ac6b765cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 438
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 -TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w16
lh3.googleusercontent.com/ 381 B
444 B 34ms
33ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b3656b9eab301548c2ce25ea05db689a2f475a1ef4ce68a09e7aa23d6be6a931

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 381
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w16
lh3.googleusercontent.com/ 417 B
480 B 33ms
33ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e135acdb3c2c1bd70906af2e93a9b233a3fe05ecbedbd5b2236efdcda7e6faee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 417
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 WXJuVDbLzZBfFYSk8BwiBKsf4fAkvxyS9Slh9DAo5NEOPYM6bDd7S68U8L8UKLJZvnieo5pnxf4HiyhvB1K0UA=w16
lh3.googleusercontent.com/ 407 B
470 B 37ms
33ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/WXJuVDbLzZBfFYSk8BwiBKsf4fAkvxyS9Slh9DAo5NEOPYM6bDd7S68U8L8UKLJZvnieo5pnxf4HiyhvB1K0UA=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

fe92a6eb2f59ce61e06edfb34e917be5138eac63b8097e8587b47931ac41659a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 407
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 bQUnb2Vox3KcySoFqr9aChfaBT-2JdUzDuZlv6PgQOmrB9n3zHgyFO_etSO8kDdfVlPuDQfEDMbyd2uQodVW5Q=w16
lh3.googleusercontent.com/ 416 B
479 B 38ms
34ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/bQUnb2Vox3KcySoFqr9aChfaBT-2JdUzDuZlv6PgQOmrB9n3zHgyFO_etSO8kDdfVlPuDQfEDMbyd2uQodVW5Q=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

aa305ca6053d5e7b1276bb407d79616830cc4b67509290a105ae265b6dbea225

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 416
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 DntvIx57RnCtFXT3MYAPt9AuIvz4XLKHJT-BticI0S0NwMlmYEtV-YKJfofwEB3gcuKyZmgzaQ3Hn9VgLMtnJQ=w16
lh3.googleusercontent.com/ 430 B
493 B 39ms
35ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/DntvIx57RnCtFXT3MYAPt9AuIvz4XLKHJT-BticI0S0NwMlmYEtV-YKJfofwEB3gcuKyZmgzaQ3Hn9VgLMtnJQ=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b030865771624c8cac4b1e100f72fb87abc3eccb6c8bedd6a25393a3c6890883

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 430
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 _cLv27DqXzglIWHABADrU2yT9UmMkrDdEy_4HCj56msO3GzwRpTW_Xqc6P0mRJuOvnGOwapFlr1yMMjpjIhXqA=w16
lh3.googleusercontent.com/ 428 B
491 B 157ms
152ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/_cLv27DqXzglIWHABADrU2yT9UmMkrDdEy_4HCj56msO3GzwRpTW_Xqc6P0mRJuOvnGOwapFlr1yMMjpjIhXqA=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ff98c4cf79d955e494a8d9bf53f00a32ae73717c16628f94f135d865ec0e127b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 428
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 S4Ayd-wkGMteQ4KkwgkxoFboWY54ehpF51PPgaQLlqkEO03fgqUtP6I-R2igjGfsZEcCMVXBHGRuEKLSJE0dVw=w16
lh3.googleusercontent.com/ 421 B
483 B 40ms
36ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/S4Ayd-wkGMteQ4KkwgkxoFboWY54ehpF51PPgaQLlqkEO03fgqUtP6I-R2igjGfsZEcCMVXBHGRuEKLSJE0dVw=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3c770cf58bc37a49b3bc7e8a8ae53168e3ae6fe8d379bd77395ac37bc9880111

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 421
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 PyuiAcJjDOAwY-Gf3RK4alIBQMlJze68clTwJQuigHj7hqAj4YxOm6ge5P8b7hZVavNgwTkqhzah7RVCamu0W8xKy8k7rQQeGQ=s0
lh3.googleusercontent.com/ 26 KB
26 KB 42ms
38ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/PyuiAcJjDOAwY-Gf3RK4alIBQMlJze68clTwJQuigHj7hqAj4YxOm6ge5P8b7hZVavNgwTkqhzah7RVCamu0W8xKy8k7rQQeGQ=s0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3cf85ecb4a6becc6460dc3e65472ca30c4ea836366cd3d6bd54e315c6f7c31e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26391
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 Y1LKhf0ke5Sx4mjNmF5QuR0OJ_eJgWm36tGewMnsqAwT9Vgi5khqwXrhOf_NUyduDk3hjrI4QG7GF8Edswsq=w16
lh3.googleusercontent.com/ 426 B
489 B 41ms
37ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Y1LKhf0ke5Sx4mjNmF5QuR0OJ_eJgWm36tGewMnsqAwT9Vgi5khqwXrhOf_NUyduDk3hjrI4QG7GF8Edswsq=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3684abe518534ed96b6bf7c7b90f54b1fc004ffee736d135aa7ee2eca2b19e63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 426
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 FG4ErIy91xCYcbduLvglqUSQRCBXDD3G99OHTMwSaQ4wlbkHfGn_69hQvlf11sw1n32wvxbdCgytwpMKyZDm3g=w16
lh3.googleusercontent.com/ 431 B
494 B 40ms
36ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/FG4ErIy91xCYcbduLvglqUSQRCBXDD3G99OHTMwSaQ4wlbkHfGn_69hQvlf11sw1n32wvxbdCgytwpMKyZDm3g=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2f1dcbe6d55182c8db429872524d1abaaf57a3a91e53cae074f15b366c8c37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 431
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 -LIWOnFZbxKfhaWJJHSKhHHCE7lMK_ER9JQngJS7XhbtcSieuc6zrJMIfDCFYk8V4Pr6V8bZzacCpNdGrbCL=w16
lh3.googleusercontent.com/ 415 B
478 B 58ms
54ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-LIWOnFZbxKfhaWJJHSKhHHCE7lMK_ER9JQngJS7XhbtcSieuc6zrJMIfDCFYk8V4Pr6V8bZzacCpNdGrbCL=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

345d333ce5a7d44a9503d94b85abacc393a6d70d0d62da52f7aa96781b0c231e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 415
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 Tc6DMUYM0t3IClKU7fwPBrfw92h_06RoEX5RRXlncQFG5BeUMAMyM_qcspNv92qKJb_OiAiM1DghBbx3TzsC=w16
lh3.googleusercontent.com/ 421 B
480 B 64ms
60ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Tc6DMUYM0t3IClKU7fwPBrfw92h_06RoEX5RRXlncQFG5BeUMAMyM_qcspNv92qKJb_OiAiM1DghBbx3TzsC=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

7f075b3a73dcd21887641aa676692b19deb19825bf0dd925747582e73217aea6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 421
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 zCBCGg93wo14GhReQgRci2U4Pp0OG4x5jDur49aouPLxDTFMC1mUk9B708tGTw679jth_kQ06n815YahSa7bltE=w16
lh3.googleusercontent.com/ 868 B
931 B 62ms
58ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/zCBCGg93wo14GhReQgRci2U4Pp0OG4x5jDur49aouPLxDTFMC1mUk9B708tGTw679jth_kQ06n815YahSa7bltE=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b673e2000e305f8929b4a0f9323169c6a00f5c8c736fbfcde0e6d3626656a5e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 868
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 n0n_ZxEfo6L0UBdqA6YIIhJ9hiuZ1vpkKq595MUbnF9Wi5cu4p4JYNoBsG7IguV5W4ErzTa5CcsOcOcJD7p1P5g=w16
lh3.googleusercontent.com/ 470 B
533 B 171ms
167ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n0n_ZxEfo6L0UBdqA6YIIhJ9hiuZ1vpkKq595MUbnF9Wi5cu4p4JYNoBsG7IguV5W4ErzTa5CcsOcOcJD7p1P5g=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

7721ea6e678ff85357eb6c7de4f39681d7b4b53b765ee49d9e45b97bdab68a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 470
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 HJzeukQ39yTqZy5ntzWnH7FqZNB-5nUukrgtJhSTrUEjHQxfCqhjB7k9aGSIvVfiLWAD0hgkVkNOGNXfPwck=w16
lh3.googleusercontent.com/ 428 B
487 B 177ms
174ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/HJzeukQ39yTqZy5ntzWnH7FqZNB-5nUukrgtJhSTrUEjHQxfCqhjB7k9aGSIvVfiLWAD0hgkVkNOGNXfPwck=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1b98e634435daa1012e8b83a1bb203eceab9742472b45c84ac1d98a729af412d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 428
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 ZGFPcrhyr3OazovWKOGqxPMJmgu5MUWCgvESgTs02NOYUbIconV_lsjO6AmdT_B9xjukv2BofQSWnuoyoNI0=w16
lh3.googleusercontent.com/ 433 B
496 B 60ms
57ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ZGFPcrhyr3OazovWKOGqxPMJmgu5MUWCgvESgTs02NOYUbIconV_lsjO6AmdT_B9xjukv2BofQSWnuoyoNI0=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ec9e6ee235b7cd2be4c02f7d9d03b70445dbe9c14b5b93422aabc12173d35fd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 433
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 EdQWQebpbwUyK7KFop1kfQ6SyNA2cSppOdT01fIamoMmcmMuvc5NcA1OZNmo33VbAa8n8212mHH23JsE05PV=w16
lh3.googleusercontent.com/ 430 B
489 B 169ms
165ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/EdQWQebpbwUyK7KFop1kfQ6SyNA2cSppOdT01fIamoMmcmMuvc5NcA1OZNmo33VbAa8n8212mHH23JsE05PV=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f0d96c4ed1e7e05e99cb5779a42e5f3b6055747c51f71c8f36ab6349fac181d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 430
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 r7NhF7sfH1PQpohFNToUlq_oa9DJJpCX0UoMbz6Zu4e4I6Dbov7mlLi-LLI83f03mepetzoL0qu-UfFDLDfHrBQ=w16
lh3.googleusercontent.com/ 431 B
490 B 61ms
58ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/r7NhF7sfH1PQpohFNToUlq_oa9DJJpCX0UoMbz6Zu4e4I6Dbov7mlLi-LLI83f03mepetzoL0qu-UfFDLDfHrBQ=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

18242158163fb9c2864cf67400e9e05ba25a96fe25eb39bdb5c9b8c7164991e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 431
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 Z7BWJaFHmaAZgr6erSEZGEreanucQggQ4WBqj7tsobiinDT9AMzmcRrcvWMRqbrOW8G1I6OPljLxGBCnB5SKzg=w16
lh3.googleusercontent.com/ 425 B
488 B 65ms
62ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Z7BWJaFHmaAZgr6erSEZGEreanucQggQ4WBqj7tsobiinDT9AMzmcRrcvWMRqbrOW8G1I6OPljLxGBCnB5SKzg=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0db972dea92bf7469a431d2820ffb388cff26a3d7be700ee81f2e36ee3974e05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 425
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 -VxZl503D7APjOLlKgbRVseHlZrWPORXRfiNglG7a4pzDY7zKhHDUaVLnkG2dluekU--Gd3vvifle527vy0S=w16
lh3.googleusercontent.com/ 414 B
477 B 70ms
67ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-VxZl503D7APjOLlKgbRVseHlZrWPORXRfiNglG7a4pzDY7zKhHDUaVLnkG2dluekU--Gd3vvifle527vy0S=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

414f94aa5dc74ec228d6aa7f37c1d79db206ff8326ded24a0cded97b75a6dfc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 414
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 TzqLPpdrFgoPI7BgT7ykes2fXK7ygO11S5SUn22L0rfE7SyWsPjMjFZJiP9uFnLBItPH74KlGepJUJqC0AB8Ng=w16
lh3.googleusercontent.com/ 421 B
480 B 67ms
64ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/TzqLPpdrFgoPI7BgT7ykes2fXK7ygO11S5SUn22L0rfE7SyWsPjMjFZJiP9uFnLBItPH74KlGepJUJqC0AB8Ng=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0d1aad9a434590d1c60dbf3d079df20d70cde2c2afd0c20773c60d0b9cacde9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 421
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 0xep3Dw-f3uLQzagTKRrrauxghj1pWI_Sqfx8ZNqzoe5UeYttk25BOYUyB0khx06MAtPN8ymfFAO6ew_Xke7DA=w16
lh3.googleusercontent.com/ 430 B
489 B 62ms
59ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/0xep3Dw-f3uLQzagTKRrrauxghj1pWI_Sqfx8ZNqzoe5UeYttk25BOYUyB0khx06MAtPN8ymfFAO6ew_Xke7DA=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0eb28d90e19b1fd3b42ea09cf5ff871e572e250e3cbf8531036d3c8a69df0cc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 430
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 yHxsZks5M9V814g5ixp5Z_5tLmLUGWjr2VY4RHPK2fAYbYQo_197RmgbUtG4xm6hC3Uh1VItt7Jue2lYHkI4=w16
lh3.googleusercontent.com/ 228 B
290 B 69ms
66ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/yHxsZks5M9V814g5ixp5Z_5tLmLUGWjr2VY4RHPK2fAYbYQo_197RmgbUtG4xm6hC3Uh1VItt7Jue2lYHkI4=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

81419462a9aa90c182deca7c5bb642a7e18d7a43a15acbbec36b54390ed9e4ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 EWi84ODdbllGo8vFON8ZWr4WCTCIUCRtru2YLRf25hq0sQUt894NAPLmjMTJupZhiYcZ-gPk813Q2T7KcSpgJFpyfXFhJiV0Kwo=w16
lh3.googleusercontent.com/ 407 B
466 B 73ms
71ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/EWi84ODdbllGo8vFON8ZWr4WCTCIUCRtru2YLRf25hq0sQUt894NAPLmjMTJupZhiYcZ-gPk813Q2T7KcSpgJFpyfXFhJiV0Kwo=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4e10bba92c73c63033b55dd271a5d535b2073d328a780a65df1eeb9714271b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 407
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 H7qUj5DToZ5yVmz_L_I8ONK3I1P-1DQg9QgYejs8Lp2ozfkJSO8kSwrH3kc5tBd4CcjaxJfXxmo_QkS6IDha4w=w16
lh3.googleusercontent.com/ 231 B
290 B 63ms
61ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/H7qUj5DToZ5yVmz_L_I8ONK3I1P-1DQg9QgYejs8Lp2ozfkJSO8kSwrH3kc5tBd4CcjaxJfXxmo_QkS6IDha4w=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d9fe2ac004861df640d03c18ba22aa04ce44c841f4672d65d785791c7f6ce5ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 231
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 ZK2SoVlvGI9iDbSVG7_1uY3zj0hENvVNq7PjVCZb6NXIm-IEnMhnLvjtOjeEcvshg1_5agL16QYj4tqWnxVnew=w16
lh3.googleusercontent.com/ 398 B
461 B 64ms
62ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ZK2SoVlvGI9iDbSVG7_1uY3zj0hENvVNq7PjVCZb6NXIm-IEnMhnLvjtOjeEcvshg1_5agL16QYj4tqWnxVnew=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

fc589cc734676f9036041dad7ab4909cb483e3e0fb859e53c9ba718eb2b93856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 398
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 aYeke8440bZ2OyWrRXNjRwN88kkgO4nRt34R7IwHwew62WU8l7RY2OF9NkfodU8safOd3kHvl13cuRPhlz-2=w16
lh3.googleusercontent.com/ 231 B
293 B 58ms
56ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/aYeke8440bZ2OyWrRXNjRwN88kkgO4nRt34R7IwHwew62WU8l7RY2OF9NkfodU8safOd3kHvl13cuRPhlz-2=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9bda86afc42cb8f1664e0fb4cb87f75a9acb9ce365f0101f475366f61b043dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 231
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 YmqHW-doKJ_v_CoBIB1yqpRMmSMks1VFVnKATiufEj-ywZfm_Om3mP6OWSCQvwRvTRm6NSBl-ddSif6VYpf6=w16
lh3.googleusercontent.com/ 420 B
482 B 71ms
69ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/YmqHW-doKJ_v_CoBIB1yqpRMmSMks1VFVnKATiufEj-ywZfm_Om3mP6OWSCQvwRvTRm6NSBl-ddSif6VYpf6=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

585b5bd39ad329c2c2252aa5728086a1823434f7b37b5f5325a9e96ced2d7171

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 420
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 ESgmyR3f5F69BNHZBnzmvL4qEdLVkwNm3E5G0STbzV2mELhc4k6m_m09iM9EA5qhp9s57y6VDhzOdyLu1_gbBf8=w16
lh3.googleusercontent.com/ 419 B
482 B 171ms
170ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ESgmyR3f5F69BNHZBnzmvL4qEdLVkwNm3E5G0STbzV2mELhc4k6m_m09iM9EA5qhp9s57y6VDhzOdyLu1_gbBf8=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

cb525f60c933094cb82ec09e748c2958f1e5ace99ebb64c1cbd1aa24e483a9d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 419
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 r4kdt7rQd-SDSaj21geckrWk3qyMcjnDTbOMvvAagwoheR1urr4rrn7omlxcu7a9EzmFyZLymMHMo25YxuppVXk=w16
lh3.googleusercontent.com/ 423 B
486 B 70ms
68ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/r4kdt7rQd-SDSaj21geckrWk3qyMcjnDTbOMvvAagwoheR1urr4rrn7omlxcu7a9EzmFyZLymMHMo25YxuppVXk=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ebe99412125723327356cad72872052a3664dd5b1af9423fd5b1590eb0bda4bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 423
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 CLuER4WjE4SohKqviflwIUaB45pYMtzzrKRv8XbaYol9RSiHa5qEPv_BQuYKGsZGWvuTw3nF1d7doXsIKLi0=w16
lh3.googleusercontent.com/ 424 B
487 B 170ms
169ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/CLuER4WjE4SohKqviflwIUaB45pYMtzzrKRv8XbaYol9RSiHa5qEPv_BQuYKGsZGWvuTw3nF1d7doXsIKLi0=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

52cbcaa92d4379acf9c8d333a4e7a94cf957730870cf8f9137dcb2b14ebb4989

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 424
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 G5eARnMwwblcFhCyfzwpAQOmN3FhRYzZMGdoPKOA1W4qbaxz4WNt636WZA6B23qm_iYBOkXk3ArxFmGzZV_yvwI=w16
lh3.googleusercontent.com/ 415 B
474 B 166ms
165ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/G5eARnMwwblcFhCyfzwpAQOmN3FhRYzZMGdoPKOA1W4qbaxz4WNt636WZA6B23qm_iYBOkXk3ArxFmGzZV_yvwI=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d293ee3cf582df8e9c7a6c090c5ef75bfaf956317e33baa007128e13c51adc8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 415
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 center.js Show response
js.center.io/ 12 KB
5 KB 115ms
32ms Script
application/javascript 2001:4860:4802:38::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/center.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::15 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: cc08eb3316359de0d8f025efee489da73ca552209a0c9cab6b00894d7fa21d42

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:51:32 GMT
content-encoding: gzip
server: Google Frontend
age: 147
etag: "OMWYXg"
content-type: application/javascript
x-cloud-trace-context: 8e417db18de51665718d1b10c3538925
cache-control: public, max-age=300
content-length: 5417
expires: Tue, 05 Mar 2024 03:56:32 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 313 KB
100 KB 109ms
57ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

99825124b6188062977bfb203c41e7dff1a4aa63c9c0e52ea89d3b519d4a9743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 101732
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2 200 BzEv7uyhqbIuwGPQJxdZTEvh36nksEIqTnjDrb_lbw0976g-e58LmT0eZXwy_99ZIvQGWIQlEXHJGha2NZwhJP0=w16
lh3.googleusercontent.com/ 3 KB
3 KB 62ms
62ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/BzEv7uyhqbIuwGPQJxdZTEvh36nksEIqTnjDrb_lbw0976g-e58LmT0eZXwy_99ZIvQGWIQlEXHJGha2NZwhJP0=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b783f0c504ed0a4be434a29c7ff64e311921553f94ff7c293817c61eef38b8a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3492
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 kkv59ZXN8Z8cKlRYxqwvObS4x5uNSnqWPBWnR6kxz8fSgJfm-TXLtIzd9XD30px2PCa9TLCMrk7cA5aZSnAT=w16
lh3.googleusercontent.com/ 3 KB
3 KB 63ms
63ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/kkv59ZXN8Z8cKlRYxqwvObS4x5uNSnqWPBWnR6kxz8fSgJfm-TXLtIzd9XD30px2PCa9TLCMrk7cA5aZSnAT=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

cda01a97f7104ba84cff0263d8415554aeb77daf70f5685eaeaad8a24bbba690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3445
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 F7Q1_8XaYidLrefUWsD_6e9WBuXQ5xnu5fmPKRg4axf379uVWJfB2GZ_-1Ls3W0ugVT3pIBuhD1Pt3g-EoTKFA=w16
lh3.googleusercontent.com/ 3 KB
3 KB 66ms
66ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/F7Q1_8XaYidLrefUWsD_6e9WBuXQ5xnu5fmPKRg4axf379uVWJfB2GZ_-1Ls3W0ugVT3pIBuhD1Pt3g-EoTKFA=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a7016a7cfb0e637059851e41e784466d87910bf1f733b8fa2a8bf07378bbfe5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3468
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 p2O47t3CGWUkWyy5ZPAE0ng4ehil8EKO7BHEt9XvoLT_0NhUxYJNx54tbm8HEGiDAwlHKHeNlGXoDeUD-D9BjA=w16
lh3.googleusercontent.com/ 3 KB
4 KB 59ms
59ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/p2O47t3CGWUkWyy5ZPAE0ng4ehil8EKO7BHEt9XvoLT_0NhUxYJNx54tbm8HEGiDAwlHKHeNlGXoDeUD-D9BjA=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e69dd0037f096afd73b3369ef649a7f7209152a79655db386aa6b8c14aec8428

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3538
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 RCGjxYTuepjcMb2bA7OSmSyRhC-o1yOAL_BQAOIG2o0DESqlrVUSNiOp6PoaiekkGbK_pWHmpCPONVB2D526=w16
lh3.googleusercontent.com/ 3 KB
3 KB 67ms
66ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/RCGjxYTuepjcMb2bA7OSmSyRhC-o1yOAL_BQAOIG2o0DESqlrVUSNiOp6PoaiekkGbK_pWHmpCPONVB2D526=w16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1c3d93aa96256b957cd33e19601438c7a61d825178ce8147db77598ed1231214

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3462
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 95ms
21ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://go.behindthemarkets.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:48:58 GMT
x-content-type-options: nosniff
age: 587101
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:48:58 GMT

GET
H3 200 cn6jPIS7oKwCInJ3b916fAhHFM_eeQ-Cwo-GU0yQwgIvu6hMYRzqF-K2dLxzAuTrXxPigHlgY0pprEYzYQ-9oCA=w16
lh3.googleusercontent.com/ 399 B
424 B 147ms
146ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/cn6jPIS7oKwCInJ3b916fAhHFM_eeQ-Cwo-GU0yQwgIvu6hMYRzqF-K2dLxzAuTrXxPigHlgY0pprEYzYQ-9oCA=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a6aa55d33b9fc7dc67c202f272d96d823d92b5094eae463bc04624194b0fbbf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 399
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 EwzQnTAj3FsKgOdbdeZeZB11HyudlZq7x85lF8PpLVx8w4NLNr-3V7867fg0IMJQXeSGLaxUA63M2VoDZ_4JOg=w16
lh3.googleusercontent.com/ 422 B
447 B 148ms
146ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/EwzQnTAj3FsKgOdbdeZeZB11HyudlZq7x85lF8PpLVx8w4NLNr-3V7867fg0IMJQXeSGLaxUA63M2VoDZ_4JOg=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e3af0de29249dd8c24fcbd59120cf0d8696ea625ac64904058dd2327e0a027d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 422
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 en5eQGS7OSwcgI6coS960qCBUmoOvVF9vMcwxy5rK1GKzsnCsseGAoOZF3yl3ijlTPP4aHcM14-J6h7pWjIM5w=w16
lh3.googleusercontent.com/ 399 B
424 B 47ms
45ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/en5eQGS7OSwcgI6coS960qCBUmoOvVF9vMcwxy5rK1GKzsnCsseGAoOZF3yl3ijlTPP4aHcM14-J6h7pWjIM5w=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9dd68156eaf50c82fc30619e23e7c8085a0e3b9b9b2095e933dfa8d6a28ac9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 399
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 OxRkQcXgAdVsmQ_XXaI6Xn25qZwDAgXwydhmfaozUdJyZVxJVxnLM2kyDfx_fc92_W_vRQmVWzRyiHZYKUyFPw=w16
lh3.googleusercontent.com/ 860 B
885 B 50ms
48ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/OxRkQcXgAdVsmQ_XXaI6Xn25qZwDAgXwydhmfaozUdJyZVxJVxnLM2kyDfx_fc92_W_vRQmVWzRyiHZYKUyFPw=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0d58b87b0743851392119f2614ac7fdaf1f2b943e5e28f53a9199e10d1cee784

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 860
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 JZC-KnICfOvdCn-NkWZ7D8dWevfFqyM36s0rtgBhuXIbzwRw7Ys7ewqYoqAW6hF7EW5ePLTNbVu3TTEMRhaaPw=w16
lh3.googleusercontent.com/ 430 B
455 B 45ms
43ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/JZC-KnICfOvdCn-NkWZ7D8dWevfFqyM36s0rtgBhuXIbzwRw7Ys7ewqYoqAW6hF7EW5ePLTNbVu3TTEMRhaaPw=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a2f6f72c5e1a1fc0ba5152253acdf2964f42ef2d259d92aa2f4fc63d760b6b6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 430
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 0_dOdpZfQ6TbbTqXF4T6AGhz8mXHexaMe7QIz7D9vIu9eB0l6aQwvF6RNqL0TOo6DR5IB4efWU3bQJvwMaIJ=w16
lh3.googleusercontent.com/ 428 B
453 B 48ms
46ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/0_dOdpZfQ6TbbTqXF4T6AGhz8mXHexaMe7QIz7D9vIu9eB0l6aQwvF6RNqL0TOo6DR5IB4efWU3bQJvwMaIJ=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

49b4681fc6a41d10bc9340d077ad5a8e34289092d68d0e8728cca1f9b7d02363

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 428
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 AItuMDlWviZeavp01sDiJWsrjDo3zX9wILgbqNyJe46EtnZy4GyLElC2BdeFInlPlXkAfju1NP9d-99Yfs00tg=w16
lh3.googleusercontent.com/ 430 B
455 B 48ms
47ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/AItuMDlWviZeavp01sDiJWsrjDo3zX9wILgbqNyJe46EtnZy4GyLElC2BdeFInlPlXkAfju1NP9d-99Yfs00tg=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

71947f7827aaada6779268465b7c05db11566497aa661961e86e83fe061a460e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 430
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 69sR3zl7OQXHha5zISOT9Qs_uPsC2eWA24Uz9jHOlC0EQ7m2eXpdFA16yOsiJi4VUouyBI5hnOAkNv6I336wk0ZjxlYKzsv0AQ=w16
lh3.googleusercontent.com/ 402 B
427 B 267ms
266ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/69sR3zl7OQXHha5zISOT9Qs_uPsC2eWA24Uz9jHOlC0EQ7m2eXpdFA16yOsiJi4VUouyBI5hnOAkNv6I336wk0ZjxlYKzsv0AQ=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4ebd979a9f0a79ff0d1526188ba0b95a5d36751f01fd16d1082779f2d11321b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 402
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 ywepIvZWgcttUdC8IQpQqjtwTb4Xsin1ylNVOVfr8PFIslp83xYxlJQ0wu9l2xNq8m9ls_9oP4IbdNABkeG4_hltjwBeDAZ2vlU=s0
lh3.googleusercontent.com/ 22 KB
22 KB 51ms
50ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ywepIvZWgcttUdC8IQpQqjtwTb4Xsin1ylNVOVfr8PFIslp83xYxlJQ0wu9l2xNq8m9ls_9oP4IbdNABkeG4_hltjwBeDAZ2vlU=s0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

dff5c7a61358f77654f6f3c48ba16e33a4315bb57389075f380c408b250c73b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22076
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 ZPiXT_syxe3P562Qx0SCYAlvVY6OlKnTOzMWR7E97WpuNu8ec68AMttCQCBOW3d_qtq5wmnwzckoMhSbrpC6nT9LkEXXNfxEx3I=s0
lh3.googleusercontent.com/ 39 KB
39 KB 165ms
164ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ZPiXT_syxe3P562Qx0SCYAlvVY6OlKnTOzMWR7E97WpuNu8ec68AMttCQCBOW3d_qtq5wmnwzckoMhSbrpC6nT9LkEXXNfxEx3I=s0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

12ad026eace6494ff61e221807c55802f6c7384c69f79439ff9765c3a3420abc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39437
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 ysrMHEBaPdf8nD2gq9fE9WKwbSE8O83fkUH8vIpTgaanZnlgppqb4lDsoPKOQjdpSMBV179CWZVBRjyqqZwG260=w16
lh3.googleusercontent.com/ 405 B
430 B 46ms
46ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/ysrMHEBaPdf8nD2gq9fE9WKwbSE8O83fkUH8vIpTgaanZnlgppqb4lDsoPKOQjdpSMBV179CWZVBRjyqqZwG260=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

88dbe5929f2b6aa111649792d1353e2b5cdad3ddc8bf49350e236fd2b955e514

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 405
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 3i03-UIVjMCEfa1KR1urJ4EaGFOUZOF3MKnVAOLuyZ8d9_-yWT8Efhs50s6zpsDMTPeo--0HUt_MQ71cmWBxkw=w16
lh3.googleusercontent.com/ 438 B
463 B 56ms
56ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/3i03-UIVjMCEfa1KR1urJ4EaGFOUZOF3MKnVAOLuyZ8d9_-yWT8Efhs50s6zpsDMTPeo--0HUt_MQ71cmWBxkw=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

802b0e03789d326a08c22fef2dffdffb8d7691e13f410e7d1d6ce72ac6b765cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 438
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 e-cxxgIJnJYF5UUFPHCqxuUprD6vZN1q1-4dG1G2n84yArjC-kQnnCHfiQhmXAF0pI4Gfbo_kDBAVyYgMk06qvdi5MWrFIiwwF8=w16
lh3.googleusercontent.com/ 402 B
427 B 50ms
49ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/e-cxxgIJnJYF5UUFPHCqxuUprD6vZN1q1-4dG1G2n84yArjC-kQnnCHfiQhmXAF0pI4Gfbo_kDBAVyYgMk06qvdi5MWrFIiwwF8=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4ebd979a9f0a79ff0d1526188ba0b95a5d36751f01fd16d1082779f2d11321b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 402
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 everflow.js Show response
www.behindthemarkets-btm.com/scripts/sdk/ 60 KB
20 KB 41ms
40ms Script
text/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.behindthemarkets-btm.com/scripts/sdk/everflow.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d2ef0e9338553c46faa28f8afe6be1e26ebd9dadaf5800642cb56f938857722

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5250
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 05 Mar 2024 02:26:29 GMT
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
server: cloudflare
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n5bXApgKi8PZzNgVD55rx2C1gisvD5DgTCFhN3mGSWxiM6SQK%2Fgj%2FGKBQaplmJr6lC4tvJHHlwpcEtovTANDDRWSJ5HVYcFBec4FWPE7n3mU61hp8jAzTqUnGhaDiuII8sOEXr9Cq4mBjaWsjxlmmT2Xhl6Jl1I%2BdcHK"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: d0469b2b-c0b1-4917-b960-cf2084ee260c
cf-ray: 85f729810b361d94-FRA

GET
H2 200 embed.js Show response
embed.lpcontent.net/leadboxes/current/ 42 KB
15 KB 115ms
24ms Script
application/javascript 34.107.203.240
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.lpcontent.net/leadboxes/current/embed.js
Requested by: Host: go.behindthemarkets.com
URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.240 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 240.203.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 5590f038f87169772f0bb512d942481838ac73230926fb92c4ff8db9a19b2296

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:52:15 GMT
content-encoding: gzip
via: 1.1 google
server: Google Frontend
age: 104
etag: "EqK-AA"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-cloud-trace-context: cf650b03ab90238acd4bc215070d6080
cache-control: public, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14811
expires: Tue, 05 Mar 2024 03:57:15 GMT

GET
H3 200 mnZ5Lf4PIFK1JislIZ3o6kbQgNit6PFTyqOhXZBIkblnERU2sb53K68KsTNtqQ9-cFCyok23vaJyKWXK7nnt=w16
lh3.googleusercontent.com/ 3 KB
3 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/mnZ5Lf4PIFK1JislIZ3o6kbQgNit6PFTyqOhXZBIkblnERU2sb53K68KsTNtqQ9-cFCyok23vaJyKWXK7nnt=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

964c07c27ddd7b81974062ffcdbc09b4f2ad97ee417ea7a37f1c8c3fc169971a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3458
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w129
lh3.googleusercontent.com/ 5 KB
5 KB 37ms
36ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/T-3lUZOkr0pGJTg2MtnJnPCAdxJl-PdaWePMpIUm6SACxhH30rYiJ__GYJwtKqQpllM0HVKLGlmwN24gcY3f=w129

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

71a0e7af96aa88155f06bb84e8b98a7a1e014b69aac7f0a7ccf5df0feb7066e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4759
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w832
lh3.googleusercontent.com/ 38 KB
39 KB 388ms
388ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/n-SU2QHHlDctT5P7f9PGVlqioYi7pTTg8gvrwvg1ZlSiRL7bP8OT_fgfmJXYifHvL5xQ1K76TrDmpB7-T6cugKs=w832

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9ce7c0c1b56dabf60220a6467217e3601a909ab2c157119fe0a81e5cb58ab683

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39413
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 -TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w728
lh3.googleusercontent.com/ 96 KB
96 KB 277ms
276ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/-TFC9jwymVFSTYLZJwBNNd3_cpc7doEJWIawODlZoO0zvFjYItyDimfoc6tOz-bgtI7t0r8DYTMLo6QAQQk3Yw=w728

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c9dca43fca509197b562e986fd472933428d757daa065972e3c349a7f963856b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 97949
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H3 200 Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w728
lh3.googleusercontent.com/ 24 KB
24 KB 38ms
38ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/Ag1U8DBGFuXf1H9sWrj9NjMaKEvgz7Ombpu9LUfiJnDAWnANfneCuZegr8dRCpGkU4uJJd-tO0NEHqSzzMBdkw=w728

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e7d37f66bd7b7ac6eb4f7e0e70d397c6af31c1b0b1cc8a996e3e9bb76c41d0d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24807
x-xss-protection: 0
expires: Wed, 06 Mar 2024 03:53:59 GMT

GET
H2 200 identify.html Show response
js.center.io/ Frame B6E4 4 KB
2 KB 32ms
32ms Document
text/html 2001:4860:4802:38::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/identify.html
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::15 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 0efa1e4687032588dae8d6d3a00a92e504a3a14b9d1bb23c19670a47c9792110

Request headers

Referer: https://go.behindthemarkets.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 223
cache-control: public, max-age=300
content-encoding: gzip
content-length: 2016
content-type: text/html
date: Tue, 05 Mar 2024 03:50:16 GMT
etag: "OMWYXg"
expires: Tue, 05 Mar 2024 03:55:16 GMT
server: Google Frontend
x-cloud-trace-context: 6064a1ee26aaf72e42750ea8da5e9a92

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/events/ 35 B
686 B 415ms
139ms XHR
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/events/capture?k=view&a=leadpage&l=wzjrg5A6gThkzqZo9c3oVh&v=&e=&st=&lc=en-US&pid=bb4wMKcXKB896PwqF4vMVT-default-prop&uid=tqg9Yh7QgCKkfrgVpoQS45&sid=oxmU74EQcrvX5X6Fo79Let&cid=lp-wzjrg5A6gThkzqZo9c3oVh&uri=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&rf=&rx=1600&ry=1200&tz=%2B01%3A00
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:53:59 GMT
Server: Stargate
Transfer-Encoding: chunked
access-control-max-age: 600
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
X-Forwarded-For: 217.114.215.132
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3hvhs4dih3bsd8ns0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 289 KB
94 KB 44ms
43ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8R6YNFMJ23&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

54231de50fe3cec30106fd79a156d8fabebb66dbe7a39de821e2a09705660565

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95822
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 238 KB
83 KB 37ms
37ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-16454845358&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae4a2edfd8ead58b477bb9e4bc01815bfeea2f7c7cec8e15d034f48c6c6df67e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84648
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 75ms
22ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 05 Mar 2024 03:32:02 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1317
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 05 Mar 2024 05:32:02 GMT

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 108ms
35ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=93258

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f4def42dbdc146434a90d9b489e2806f313b4af31f4d36cac96323f8a2bd20d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 160ms
87ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=108898

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8e84fdb2aa9c03cbdca971f812f33cdb5c1f90400b22bce290262601baff8da6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 167ms
94ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=108895

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6c943beb222b0cebaa0c1b47b41dcb6a703ededdba41fe89bb8740041930e186

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 179ms
107ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=108896

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7dae7506dbc59857048b2a8e26109ffd2788cb58ed74cb778d3c73a2db43c0ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 219ms
147ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=108897

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

059bf725c90c5b2f107bdec23a77bd5e6af7bb0de3131164f699536759c7a35d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 194ms
123ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=109892

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b9cb40fe5555cb856a15c054c364444f99d11229bedf4881082e7e228b86040e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 47 KB
20 KB 112ms
112ms Script
application/javascript 2a02:2638:3::e
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=109899

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::e , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3f8055f98bd55c13f3efe6a6b93109523efba17e3c50ac615dd8c946d6142918

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1616895/ 70 KB
22 KB 281ms
225ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1616895/tfa.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dd9c7fa4b462f664ef8723720ab8966d964caddb5e2b9c373def1ddb52cb0268

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: cEH7X6quah00Zr2aqz2viGnYDYeKM6Uv
content-encoding: gzip
via: 1.1 varnish
date: Tue, 05 Mar 2024 03:53:59 GMT
x-amz-request-id: E24ZDRXFYQ61PCHT
age: 0
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 21560
x-amz-id-2: S6+4ba/ZP+aXvOvawY6u2Qu7JrGATjYIKlZgK7+GraFZInEao6MHf53bHW1LbmiwN0k4bVQX04U=
x-served-by: cache-fra-etou8220110-FRA
last-modified: Sun, 03 Mar 2024 11:13:53 GMT
server: AmazonS3
x-timer: S1709610839.430773,VS0,VE202
etag: "dcbc93b77ba1323bf36a4e4a8aa6c46d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 8
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
84 KB 43ms
43ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-660882099

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WNRH3TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e9d56025d016f39fd1dd58e4de2fd20639a044fa33896f11e94636049ba76545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85649
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2 200 / Show response
btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/ Frame 2359 92 KB
19 KB 564ms
258ms Document
text/html 35.202.21.90
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96

Requested by

Host: embed.lpcontent.net
URL: https://embed.lpcontent.net/leadboxes/current/embed.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.202.21.90 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

90.21.202.35.bc.googleusercontent.com

Software

Leadpages /

Resource Hash

5a2228ec45f0e70c04e60b4020ed6c5fb327cb05a4ed9073bfcbb5735d9f0b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://go.behindthemarkets.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache
content-encoding: br
content-type: text/html
date: Tue, 05 Mar 2024 03:53:59 GMT
etag: W/"d745c30c70eac79bfedca58e5fc351a2"
last-modified: Thu, 01 Feb 2024 13:26:19 GMT
server: Leadpages
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: MISS, HIT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/16454845358/ 3 KB
2 KB 85ms
36ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/16454845358/?random=1709610839441&cv=11&fst=1709610839441&bg=ffffff&guid=ON&async=1&gtm=45be42t1z8812088355za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&hn=www.googleadservices.com&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&pscdl=noapi&auid=1894276809.1709610839&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-16454845358&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b59d37480876f27ebc4cddadc46b534b485541a42bdbb6ffb2aa071ea6c74cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1401
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
259 B 83ms
29ms Ping
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-8R6YNFMJ23&gtm=45je42t1v874108444z8812088355za220&_p=1709610839156&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1060397573.1709610840&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709610839&sct=1&seg=0&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&dt=%22Cut%20%26%20Paste%22&en=page_view&_fv=1&_nsi=1&_ss=1&epn.variant_id=0&tfd=1575
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8R6YNFMJ23&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://go.behindthemarkets.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
259 B 84ms
28ms Ping
text/plain 2a00:1450:400c:c02::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8R6YNFMJ23&cid=1060397573.1709610840&gtm=45je42t1v874108444z8812088355za220&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8R6YNFMJ23&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://go.behindthemarkets.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.az/ads/ 42 B
408 B 85ms
33ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.az/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8R6YNFMJ23&cid=1060397573.1709610840&gtm=45je42t1v874108444z8812088355za220&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&z=1408569052

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/660882099/ 3 KB
2 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/660882099/?random=1709610839545&cv=11&fst=1709610839545&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9138725453za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&hn=www.googleadservices.com&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&pscdl=noapi&auid=1894276809.1709610839&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-660882099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d126f9c9e8dd0810f8f2f0073f20041d4ade64615fa368cd72e64430d86d7ef4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1417
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
214 B 30ms
29ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1630293561&t=pageview&_s=1&dl=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&ul=en-us&de=UTF-8&dt=%22Cut%20%26%20Paste%22&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1196826219&gjid=1669721739&cid=1060397573.1709610840&tid=UA-102395123-1&_gid=500381637.1709610840&_r=1&_slc=1&gtm=45He42t1n81WNRH3TXv812088355za200&cd1=96&cd2=c23aa525a8ea48c493cb0d529d299ad7&cd3=false&cd4=false&cd5=false&cd6=false&cd7=false&gcd=13l3l3l3l1&dma=0&z=1070029142

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.behindthemarkets.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://go.behindthemarkets.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/16454845358/ 42 B
455 B 82ms
33ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/16454845358/?random=1709610839441&cv=11&fst=1709607600000&bg=ffffff&guid=ON&async=1&gtm=45be42t1z8812088355za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqxY3LM69GOQGAFdDUpHQ2kZvlKLwEBg&random=1237842438&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.az/pagead/1p-user-list/16454845358/ 42 B
154 B 34ms
34ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.az/pagead/1p-user-list/16454845358/?random=1709610839441&cv=11&fst=1709607600000&bg=ffffff&guid=ON&async=1&gtm=45be42t1z8812088355za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqxY3LM69GOQGAFdDUpHQ2kZvlKLwEBg&random=1237842438&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 17E8 14 KB
6 KB 137ms
48ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=go.behindthemarkets.com&origin=onetag

Requested by

Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=93258

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ff9ce35d5fae856bab207c9f8d8eb3dff6354f007ea9f9b9a32f5cc018d52876

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://go.behindthemarkets.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 03:53:58 GMT
server: Kestrel
server-processing-duration-in-ticks: 393285
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 /
www.google.com/pagead/1p-user-list/660882099/ 42 B
108 B 80ms
34ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/660882099/?random=1709610839545&cv=11&fst=1709607600000&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9138725453za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqpmOH9rMslHzQxYsHKjBGD7icYHCRUnt42gUh7KWkbc6fw8JH&random=3395222873&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.az/pagead/1p-user-list/660882099/ 42 B
108 B 33ms
33ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.az/pagead/1p-user-list/660882099/?random=1709610839545&cv=11&fst=1709607600000&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9138725453za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&frm=0&tiba=%22Cut%20%26%20Paste%22&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqpmOH9rMslHzQxYsHKjBGD7icYHCRUnt42gUh7KWkbc6fw8JH&random=3395222873&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/1616895/trc/3/ 2 KB
2 KB 52ms
44ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1616895/trc/3/json?tim=1709610839665&data=%7B%22id%22%3A597%2C%22ii%22%3A%22%2Flimited-time-offer-4%3Fid%3D%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1709610839656%2C%22cv%22%3A%2220240303-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dbehindthemarkets-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1709610839664%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96%22%2C%22tos%22%3A7%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22ler%22%3A%22other%22%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1616895/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 4962cbc7e69cb7836432434c2aad9ebbdbc8cde2edd0cd087fb4748f87340757

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-vcl-time-ms: 20
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: gzip
via: 1.1 varnish
cpu: 0.0875
x-fastly-to-nlb-rtt: 7453
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-etou8220110-FRA
x-log-content-encoding: gzip
server: nginx
x-timer: S1709610840.687385,VS0,VE20
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 29ms
29ms XHR
text/plain 2a00:1450:400c:c02::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-102395123-1&cid=1060397573.1709610840&jid=1196826219&gjid=1669721739&_gid=500381637.1709610840&_u=YADAAEAAAAAAACAAI~&z=1753790616

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3ad08651cf80af4f5cee753d0f2aa2bc56f895f5aee2a833b6e674d149a4e072

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.behindthemarkets.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://go.behindthemarkets.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 36ms
35ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-102395123-1&cid=1060397573.1709610840&jid=1196826219&_u=YADAAEAAAAAAACAAI~&z=1130950800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.az/ads/ 42 B
63 B 33ms
33ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.az/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-102395123-1&cid=1060397573.1709610840&jid=1196826219&_u=YADAAEAAAAAAACAAI~&z=1130950800

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 17E8
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=behindthemarkets.com&sn=ChromeSyncframe&so=0&topUrl=go.behindthemarkets.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=JgZt2nxVeWxQSnY3NEZGVUJmQjJpWHA0S0Znek5ONDNKWURMajlMRWpsSUpaUEN1WS9ENkZVOTFZV1FPK29VVjR2Y1haMk1zY3MzcWxwbmExSkRVdDRmU1JKNXVLS2NieTYzeGE0bGRrRldjajd6aDAveEdmVlAxRlJRSj...

449 B
671 B

46ms
46ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=JgZt2nxVeWxQSnY3NEZGVUJmQjJpWHA0S0Znek5ONDNKWURMajlMRWpsSUpaUEN1WS9ENkZVOTFZV1FPK29VVjR2Y1haMk1zY3MzcWxwbmExSkRVdDRmU1JKNXVLS2NieTYzeGE0bGRrRldjajd6aDAveEdmVlAxRlJRSjU1d3JFeS85RGRxdVlzcDV5VEZPUm9RMng4M2RHYTRRc2tUR2hXaFpaMTQrTEMzRlFiQnFvVWJXS3AwWm5rcytrYWlWVC9RZ2VvSW1UVEd6N3V5NTE0L1ZIbnZzZHlFMElRbnJaNDVEQWJ2ek1JRzYzNk9OaWoyUnQxNVNNcXN2cEkyN2laaWc1VHdvendpbmVXQkJLdks4UElyU25HWkl4T1BaaVBQNUl6UlFWVmVVMHdMST18&cppv=2

Requested by

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

565830745646683f536304cbacfed76d4fa6e783432a5b007a0d777430608731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1318172
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=JgZt2nxVeWxQSnY3NEZGVUJmQjJpWHA0S0Znek5ONDNKWURMajlMRWpsSUpaUEN1WS9ENkZVOTFZV1FPK29VVjR2Y1haMk1zY3MzcWxwbmExSkRVdDRmU1JKNXVLS2NieTYzeGE0bGRrRldjajd6aDAveEdmVlAxRlJRSjU1d3JFeS85RGRxdVlzcDV5VEZPUm9RMng4M2RHYTRRc2tUR2hXaFpaMTQrTEMzRlFiQnFvVWJXS3AwWm5rcytrYWlWVC9RZ2VvSW1UVEd6N3V5NTE0L1ZIbnZzZHlFMElRbnJaNDVEQWJ2ek1JRzYzNk9OaWoyUnQxNVNNcXN2cEkyN2laaWc1VHdvendpbmVXQkJLdks4UElyU25HWkl4T1BaaVBQNUl6UlFWVmVVMHdMST18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 253086
content-length: 0
expires: 0

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 398ms
133ms XHR
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?origin=&version=1.2.2&correlateBy=NWC47rFt9o9kndtxpyfGPg&kind=timer,counter,text&label=lb_embed_embed_script_load,lb_embed_exit-intent_tigger_queue,lb_embed_leadbox_embedded&value=124.60000038146973,1,NcYxqUsAsLkrkeQU6QFqDL
Requested by: Host: embed.lpcontent.net
URL: https://embed.lpcontent.net/leadboxes/current/embed.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:00 GMT
Server: Stargate
Transfer-Encoding: chunked
access-control-max-age: 600
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
X-Forwarded-For: 217.114.215.132
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3hv1kc2cc08708g3g

GET
H2

200

event Show response
widget.us.criteo.com/
Redirect Chain

https://sslwidget.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFR...
https://widget.us.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFR...

10 KB
5 KB

341ms
123ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFRZHpNMFNVc3VwREtEQUhMZk8xSkRiekZTZlBxZTBYd252UlJPZWpBcnFJMGpxRFFMTXFHdzRUMiUyQnNaT2RZSmpybE1GYnElMkJjZkM2WGMyOXNtNGRKZEdNOHU2dFl4YWZtWHRGVFVMR1NRM1NGZ0czcTVtN2RjODdPNUg2d2UlMkZSME44dCUyQkpOZyUyRnBORnM4JTNE&tld=behindthemarkets.com&dy=1&fu=https%253A%252F%252Fgo.behindthemarkets.com%252Flimited-time-offer-4%252F%253F_ef_transaction_id%253Dc23aa525a8ea48c493cb0d529d299ad7%2526utm_source%253D96%2526utm_campaign%253D529%2526utm_medium%253Dmbu12559537%2526id%253D%2526iocid%253D%2526oid%253D1%2526aff%253D96&ceid=644851f4-c07c-469f-be39-15e29452bbbb&dtycbr=44123

Requested by

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ed62884cea0e207677cc0143956e77598ef314edb16c04cab4d57e9b832d49d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
content-type: application/x-javascript
access-control-allow-origin: *
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 16277412
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-origin: *
location: https://widget.us.criteo.com/event?a=93258&v=5.23.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26tms%3Dgtm-template%26p%3D1&p2=e%3Ddis&adce=1&bundle=kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFRZHpNMFNVc3VwREtEQUhMZk8xSkRiekZTZlBxZTBYd252UlJPZWpBcnFJMGpxRFFMTXFHdzRUMiUyQnNaT2RZSmpybE1GYnElMkJjZkM2WGMyOXNtNGRKZEdNOHU2dFl4YWZtWHRGVFVMR1NRM1NGZ0czcTVtN2RjODdPNUg2d2UlMkZSME44dCUyQkpOZyUyRnBORnM4JTNE&tld=behindthemarkets.com&dy=1&fu=https%253A%252F%252Fgo.behindthemarkets.com%252Flimited-time-offer-4%252F%253F_ef_transaction_id%253Dc23aa525a8ea48c493cb0d529d299ad7%2526utm_source%253D96%2526utm_campaign%253D529%2526utm_medium%253Dmbu12559537%2526id%253D%2526iocid%253D%2526oid%253D1%2526aff%253D96&ceid=644851f4-c07c-469f-be39-15e29452bbbb&dtycbr=44123
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 14003202
timing-allow-origin: *
content-length: 0
expires: 0

GET
H2 200 all.min.css
static.leadpages.net/fonts/font-awesome/6.4.2/css/ Frame 2359 100 KB
26 KB 25ms
24ms Stylesheet
text/css 34.107.203.240
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.leadpages.net/fonts/font-awesome/6.4.2/css/all.min.css
Requested by: Host: btm-btm-btm.lpages.co
URL: https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.240 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 240.203.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Fri, 01 Mar 2024 11:24:31 GMT
content-encoding: gzip
via: 1.1 google
server: Google Frontend
age: 318568
etag: "EqK-AA"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-cloud-trace-context: fa5ba0bf92c9944a8d4063822e577d8f
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26836
expires: Sat, 01 Mar 2025 11:24:31 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 2359 22 KB
2 KB 33ms
32ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,500,700

Requested by

Host: btm-btm-btm.lpages.co
URL: https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

923bb1d333ca289850f06f8c32113212357241945d07ac9d2fc7790a1bdf5f3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 03:53:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 02:44:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 03:53:59 GMT

GET
H2

200

spectre.min.css
unpkg.com/spectre.css@0.5.9/dist/ Frame 2359
Redirect Chain

https://unpkg.com/spectre.css/dist/spectre.min.css
https://unpkg.com/spectre.css@0.5.9/dist/spectre.min.css

46 KB
10 KB

32ms
32ms

Stylesheet
text/css

2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/spectre.css@0.5.9/dist/spectre.min.css

Requested by

Protocol

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beb6e5817e7f1f16be8426abc571e4882ee5bfdbf3d24de63623ca5018d8f7aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 8202218
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HGHXPJ2DBK1QT7ZE91FEM1MM-fra
server: cloudflare
etag: W/"b640-gQ07fCV82R4u/3QXaqBjXwq8x+8"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 85f729863e59193b-FRA

Redirect headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: EXPIRED
fly-request-id: 01HR6BYBYBGHMB7KG6Z2YQNGY6-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /spectre.css@0.5.9/dist/spectre.min.css
cache-control: public, s-maxage=600, max-age=60
cf-ray: 85f72985fe22193b-FRA

GET
H2

200

spectre-exp.min.css
unpkg.com/spectre.css@0.5.9/dist/ Frame 2359
Redirect Chain

https://unpkg.com/spectre.css/dist/spectre-exp.min.css
https://unpkg.com/spectre.css@0.5.9/dist/spectre-exp.min.css

23 KB
4 KB

33ms
33ms

Stylesheet
text/css

2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/spectre.css@0.5.9/dist/spectre-exp.min.css

Requested by

Protocol

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c53fc919da515cc21b389888f6d7a95f69303b518a7f735c11534473f4e2eec7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 10804449
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HE4C0RV5D5ZK5TQRZ7ZXQZJF-fra
server: cloudflare
etag: W/"5c9f-xu4/dhgg88SClaf2EtNgCRsbXuA"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 85f729863e5b193b-FRA

Redirect headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: EXPIRED
fly-request-id: 01HR6BYBYBKKF2V7TZVV2CB8C0-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /spectre.css@0.5.9/dist/spectre-exp.min.css
cache-control: public, s-maxage=600, max-age=60
cf-ray: 85f72985fe23193b-FRA

GET
H2

200

spectre-icons.min.css
unpkg.com/spectre.css@0.5.9/dist/ Frame 2359
Redirect Chain

https://unpkg.com/spectre.css/dist/spectre-icons.min.css
https://unpkg.com/spectre.css@0.5.9/dist/spectre-icons.min.css

9 KB
2 KB

31ms
31ms

Stylesheet
text/css

2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/spectre.css@0.5.9/dist/spectre-icons.min.css

Requested by

Protocol

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b9dbc4e3ab31dc403745b54ac6ca7f853ecd69084036b8be7de5a1890ccec49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 10025130
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HEVK7PG1PZWEV0KNKT17FN01-fra
server: cloudflare
etag: W/"2296-zDQAAP+l3l3eglqbK/5ezmaPOAg"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 85f729863e56193b-FRA

Redirect headers

date: Tue, 05 Mar 2024 03:54:00 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: EXPIRED
fly-request-id: 01HR6BYBYABHS2YN5H5KX71V73-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /spectre.css@0.5.9/dist/spectre-icons.min.css
cache-control: public, s-maxage=600, max-age=60
cf-ray: 85f72985fe21193b-FRA

GET
H2 200 validator.min.js Show response
cdnjs.cloudflare.com/ajax/libs/validator/10.8.0/ Frame 2359 31 KB
11 KB 74ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/validator/10.8.0/validator.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e2c27b9ba576b52452df883ee0d1e4c2bcf284dd948611e484c1797a5b2ed0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1673953
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10199
last-modified: Mon, 04 May 2020 16:17:27 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04017-7d11"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72h9UC8VzKu%2Be6wdztl4GFaGpjncBJty5DMqa%2F6CCR8VD42HrcapvcXahMgxzQXHQxz0N%2FotWtobEczk9M2xXduUIGw687o8wcnD4%2BMGwJpG072T4rF9aTerVaT%2BOEdsiSnOPBGr7PpuVyxNIaLrr5Xr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f72985f82839ee-FRA
expires: Sun, 23 Feb 2025 03:54:00 GMT

GET
H2 200 3329.js Show response
script.crazyegg.com/pages/scripts/0075/ Frame 2359 6 KB
2 KB 504ms
440ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0075/3329.js
Requested by: Host: btm-btm-btm.lpages.co
URL: https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a538b25a98b4c57396b9942d893856f0625144e5b4076b8823c86117fbf50e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Tue, 05 Mar 2024 03:54:00 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
ce-version: 11.5.193
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f72986de4368fd-FRA
content-length: 2224

GET
H3 200 VLgIlRWwyuqrKOm736AjXTjkROiss352Mgs5-M-Ui16nTG9YsmHhynwbjI8-yA2ZV0iHc0AuC-swQE2K7juRgCDf5-ERBRM-rU8E=w16
lh3.googleusercontent.com/ Frame 2359 305 B
331 B 136ms
136ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/VLgIlRWwyuqrKOm736AjXTjkROiss352Mgs5-M-Ui16nTG9YsmHhynwbjI8-yA2ZV0iHc0AuC-swQE2K7juRgCDf5-ERBRM-rU8E=w16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d56ad0781875c34060e15e238f8f8cb621c132675a63e3b90ffe23a2918e4639

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
content-disposition: inline;filename="unnamed.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 305
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 06 Mar 2024 03:54:00 GMT

GET
H2 200 center.js Show response
js.center.io/ Frame 2359 12 KB
5 KB 31ms
31ms Script
application/javascript 2001:4860:4802:38::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/center.js
Requested by: Host: btm-btm-btm.lpages.co
URL: https://btm-btm-btm.lpages.co/serve-leadbox/NcYxqUsAsLkrkeQU6QFqDL/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&aff=96&id=&iocid=&oid=1&utm_campaign=529&utm_medium=mbu12559537&utm_source=96
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::15 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: cc08eb3316359de0d8f025efee489da73ca552209a0c9cab6b00894d7fa21d42

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:09 GMT
content-encoding: gzip
server: Google Frontend
age: 51
etag: "OMWYXg"
content-type: application/javascript
x-cloud-trace-context: c1f9c0c92e6a9a9c39f23b1bb200dc4b
cache-control: public, max-age=300
content-length: 5417
expires: Tue, 05 Mar 2024 03:58:09 GMT

GET
H2 200 identify.html Show response
js.center.io/ Frame 6A40 4 KB
2 KB 30ms
30ms Document
text/html 2001:4860:4802:38::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.center.io/identify.html
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::15 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 0efa1e4687032588dae8d6d3a00a92e504a3a14b9d1bb23c19670a47c9792110

Request headers

Referer: https://btm-btm-btm.lpages.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 87
cache-control: public, max-age=300
content-encoding: gzip
content-length: 2016
content-type: text/html
date: Tue, 05 Mar 2024 03:52:33 GMT
etag: "OMWYXg"
expires: Tue, 05 Mar 2024 03:57:33 GMT
server: Google Frontend
x-cloud-trace-context: 06f58817ebd93e0b397880d0ed98a1d2

GET
H2 200 btm-btm-btm.lpages.co.json Show response
script.crazyegg.com/pages/data-scripts/0075/3329/site/ Frame 2359 1023 B
724 B 179ms
134ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0075/3329/site/btm-btm-btm.lpages.co.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0075/3329.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41845643818a27f792ca43705202c1c9df32214240d3f6682e4d78d2b0a327b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Tue, 05 Mar 2024 03:54:00 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
ce-version: 11.5.193
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f72989eb6a6987-FRA
content-length: 457

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 03B0 170 B
409 B 90ms
32ms Image
image/png 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-FWLCi4-fFf72OFWPyweTCe53u4LTQZ3mPhnW1A&google_cm&google_hm=ay1GV0xDaTQtZkZmNzJPRldQeXdlVENlNTN1NExUUVozbVBoblcxQQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 03B0 43 B
235 B 281ms
31ms Image
image/gif 35.214.149.91
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-64WaoI-fFf72OFWPyweTCe53u4Jr4W1eUckwKQ&expires=30
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.214.149.91 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 91.149.214.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 03B0
Redirect Chain

https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6215474940901846295

43 B
369 B

31ms
31ms

Image
image/gif

178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6215474940901846295

Protocol

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 968113
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
an-x-request-uuid: cc7b8107-f500-4d44-99e8-0bcf547bed7f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6215474940901846295
x-proxy-origin: 217.114.215.132; 217.114.215.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame 03B0 53 B
809 B 108ms
49ms Image
image/gif 95.101.148.20
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-KwkIoY-fFf72OFWPyweTCe53u4LjUR2FJX8akg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.148.20 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-101-148-20.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 03:54:00 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
alt-svc: h3=":443"; ma=93600
content-length: 53
x-mnet-hl2: E
expires: Tue, 05 Mar 2024 03:54:00 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 03B0 0
239 B 116ms
24ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-TBT5qY-fFf72OFWPyweTCe53u4K3p14iPzHTmA&expires=30
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 03B0 43 B
163 B 99ms
28ms Image
image/gif 81.17.55.116
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-XHj_nI-fFf72OFWPyweTCe53u4JF_yyyY0PSMQ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 81.17.55.116 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:53:59 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 03B0 0
99 B 119ms
27ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-mFwvGo-fFf72OFWPyweTCe53u4LH4tjR_MOyAA
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 26906

GET
H2 200 um
criteo-sync.teads.tv/ Frame 03B0 23 B
163 B 178ms
59ms Image
image/gif 2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-LeJMuY-fFf72OFWPyweTCe53u4IUyvLp3l2NrQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 05 Mar 2024 03:54:00 GMT
pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H2 200 xuid
eb2.3lift.com/ Frame 03B0 37 B
140 B 90ms
24ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2711&xuid=k-6HDEbo-fFf72OFWPyweTCe53u4IHheQwRsLprA&dongle=013b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2 200 cksync.php
hb.yahoo.net/ Frame 03B0 52 B
315 B 203ms
55ms Image
image/gif 2.21.22.153
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hb.yahoo.net/cksync.php?cs=1&type=58301&ovsid=k-azw9_I-fFf72OFWPyweTCe53u4IIyZqEmvvFvw

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.22.153 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-21-22-153.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5f20338b9aab2f5f33562eb3b0b23d999896ce426cacd2231b4123510571df4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Tue, 05 Mar 2024 03:54:00 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 52
x-mnet-hl2: E
expires: Tue, 05 Mar 2024 03:54:00 GMT

GET
H2 200 pixel
cm.adform.net/ Frame 03B0 43 B
163 B 124ms
33ms Image
image/gif 37.157.3.20
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/pixel?adform_pid=15&adform_pc=k-8IR85I-fFf72OFWPyweTCe53u4IoX9ZoCTSfWA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.3.20 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
last-modified: Fri, 18 Nov 2022 14:41:46 GMT
server: nginx
accept-ranges: bytes
etag: "637799aa-2b"
content-length: 43
content-type: image/gif

GET
H2 200 sync
visitor.omnitagjs.com/visitor/ Frame 03B0 49 B
342 B 143ms
46ms Image
image/gif 185.255.84.153
IGUANE-

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=732efe97317e6352de4c1caf24b5064b&name=CRITEO&visitor=k-gvdxQo-fFf72OFWPyweTCe53u4LN2KBaR9VgRA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.153 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 4
content-length: 49
expires: 0

GET
H2

200

rum
r.casalemedia.com/ Frame 03B0
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA&C=1

43 B
324 B

47ms
47ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LYl6mNk0v2GwU3j9DiAp%2BE%2FUIVBCrWS6drvFeYwO2PuRtZSgLaWzFXXbmSu87CjNZ1yMKRoDu4o80ZHl97Z5nthA6Bkz5dx49bBc5x%2Bkbch22bKSIeXqMDnF88fHb5G8lhvf"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85f7298aeae64d70-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mWUDi%2FyvWXc2thJwGUwaVsX7N5BvwXt2wYG7N8DKvNbAu6agekp8rD90jNUq3OKRe4tmHcx4%2Bk6172I%2B6eEWfqp1jMYoSyhWEaIB7BQa5mDqBsfS37JFdH6RG4q2VovfOAHC"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=20&external_user_id=k-GvZzHo-fFf72OFWPyweTCe53u4LGAZHQKQBeoA&C=1
cache-control: no-cache
cf-ray: 85f7298aaabc4d70-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame 03B0
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv

42 B
716 B

48ms
48ms

Image
image/gif

34.251.106.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv

Protocol

Server

34.251.106.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-106-238.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v057-0edf80f2c.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: N3rc2H39Tig=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-2-v057-013b23b86.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: JMkO2D1uTNQ=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=AJd7a-d3EsEycBglkjMP-TrEXX9-jjvv
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 9.gif
id5-sync.com/s/966/ Frame 03B0 43 B
1 KB 81ms
24ms Image
image/gif 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/s/966/9.gif?puid=k-kBKHzY-fFf72OFWPyweTCe53u4J2A-jbpUy_Aw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203256.ip-141-95-33.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 05 Mar 2024 03:54:00 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2 200 match
ad.360yield.com/ Frame 03B0 43 B
199 B 188ms
50ms Image
image/gif 54.73.231.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-q3ydMY-fFf72OFWPyweTCe53u4IFAvJ9YE_twA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.73.231.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-231-133.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 05 Mar 2024 03:54:00 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 sync
matching.ivitrack.com/ Frame 03B0 42 B
265 B 86ms
32ms Image
image/gif 34.117.157.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matching.ivitrack.com/sync?realm=criteo&uid=k-x9JUX4-fFf72OFWPyweTCe53u4IUIy7nK35Iow
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.157.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.157.117.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
x-envoy-decorator-operation: tag-manager.programmatic.svc.cluster.local:3000/*
via: 1.1 google
server: istio-envoy
content-type: image/gif
cache-control: public, max-age=86400
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 push
exchange.mediavine.com/usersync/ Frame 03B0 0
880 B 77ms
25ms Image
text/html 52.58.90.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-aAqlmo-fFf72OFWPyweTCe53u4Ji4OdQJLYh8Q
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.90.171 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-90-171.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
cache-control: private, no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: text/html; charset=utf-8

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame 03B0 43 B
423 B 180ms
49ms Image
image/gif 63.32.163.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-qtPELI-fFf72OFWPyweTCe53u4IlNag5k_sebg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.32.163.40 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-32-163-40.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
server: nginx
content-type: image/gif
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 03B0 0
218 B 450ms
111ms Image
text/plain 64.202.112.31
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.outbrain.com/cookie-sync?p=criteo&uid=k--qzJzY-fFf72OFWPyweTCe53u4IcCz96-8b4xg&initiator=partner

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:01 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-TraceId: 980a76715160365fa4ab4ca6f7da4371
Content-Length: 0

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 03B0 0
225 B 122ms
33ms Image
text/html 185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-Y28nMY-fFf72OFWPyweTCe53u4Impa05UpBRAg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 03:54:00 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 204 v1
match.sharethrough.com/sync/ Frame 03B0 0
35 B 107ms
25ms Image
text/plain 3.122.11.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-37H_MY-fFf72OFWPyweTCe53u4K7mihIUav_LA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.11.77 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-11-77.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 03B0 43 B
398 B 401ms
114ms Image
image/gif 2600:1f18:612b:4200:b1c9:bbe6:9d18:57f1
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-R2b0VY-fFf72OFWPyweTCe53u4Kg80EEqwUJeQ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4200:b1c9:bbe6:9d18:57f1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Tue, 05 Mar 2024 03:54:01 GMT
server: nginx
content-type: image/gif

GET
H2 200 getusermatch.php
a.twiago.com/rtb/ Frame 03B0 43 B
153 B 279ms
41ms Image
image/gif 85.215.5.31
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.twiago.com/rtb/getusermatch.php?dataid=6&external_user_id=k-Gwc6lI-fFf72OFWPyweTCe53u4KBOKn6Roy1LQ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.215.5.31 , Germany, ASN6786 (CRONON-BERLIN-AS, DE),
Reverse DNS
Software: Apache / PHP/7.3.30
Resource Hash: 5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 05 Mar 2024 03:54:01 GMT
server: Apache
x-powered-by: PHP/7.3.30
content-length: 43
content-type: image/gif

GET
H/1.1 204
No Content m
ad.yieldlab.net/ Frame 03B0 0
235 B 86ms
33ms Image
text/plain 23.32.185.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.yieldlab.net/m?dt_id=8664&ext_id=k-y1RZGY-fFf72OFWPyweTCe53u4JMTr6Lln_wCA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.185.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-192.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Mar 2024 03:54:00 GMT
Cache-Control: no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection: keep-alive
Expires: Mon, 04 Mar 2024 03:54:00 GMT

GET
H2 200 sync
sync-criteo.ads.yieldmo.com/ Frame 03B0 0
38 B 210ms
45ms Image
text/plain 52.210.94.187
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-criteo.ads.yieldmo.com/sync?id=k--DUrHY-fFf72OFWPyweTCe53u4KygW0xXs3Q6Q&pn_id=criteo&ext=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.94.187 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-94-187.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:01 GMT
content-length: 0

GET
H2 204 put
e1.emxdgt.com/ Frame 03B0 0
44 B 81ms
21ms Image
text/plain 52.28.138.244
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d53&uid=k-9XqoK4-fFf72OFWPyweTCe53u4KF_VNQnj0QgA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.138.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-138-244.eu-central-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:00 GMT
server: awselb/2.0

GET
H/1.1 200
OK capture
api.leadpages.io/analytics/v1/observations/ 35 B
357 B 131ms
131ms Image
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?version=1.7.13&origin=page-speed&kind=timer,timer,timer,timer,timer,timer,timer,timer,timer,timer&label=domain-lookup,connect,request,ttfb,response,loading,interactive,content-loaded,complete,load&value=0,299,259,592,143,594,798,799,2126,2138
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:00 GMT
Server: Stargate
Transfer-Encoding: chunked
X-Forwarded-For: 217.114.215.132
Content-Type: image/gif
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3hvrpo56mqgt017v0

GET
H2 200 setuid
ib.adnxs.com/ Frame 03B0 43 B
1 KB 31ms
31ms Image
image/gif 185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=52&code=k-_v7KP4-fFf72OFWPyweTCe53u4IEK1cp7Ap-5g

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 03:54:00 GMT
an-x-request-uuid: a91b8276-5f91-4d05-8cac-b7657f8ae84b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.132; 217.114.215.132; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 03B0
Redirect Chain

https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=eVii9OBrltGK9OCyohrVQVstYy48_5V-

0
44 B

169ms
44ms

Image
text/plain

52.19.180.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=eVii9OBrltGK9OCyohrVQVstYy48_5V-
Protocol: H2
Server: 52.19.180.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-180-99.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 03:54:01 GMT
server: awselb/2.0

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=eVii9OBrltGK9OCyohrVQVstYy48_5V-
date: Tue, 05 Mar 2024 03:54:00 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 658662
content-length: 0

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 134ms
133ms XHR
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?origin=&version=1.2.2&correlateBy=NWC47rFt9o9kndtxpyfGPg&kind=timer&label=lb_embed_leadbox_load&value=1197.5
Requested by: Host: embed.lpcontent.net
URL: https://embed.lpcontent.net/leadboxes/current/embed.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:01 GMT
Server: Stargate
Transfer-Encoding: chunked
access-control-max-age: 600
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
X-Forwarded-For: 217.114.215.132
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3hv8tb6m4m6d0ikhg

GET
H2 204 unip Show response
trc-events.taboola.com/1616895/log/3/ 0
251 B 55ms
28ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1616895/log/3/unip?en=pre_d_eng_tb&tos=1557&scd=0&ssd=1&est=1709610839658&ver=36&isls=true&src=i&invt=1500&msa=52460&rv=1&tim=1709610841215&vi=1709610839656&ri=edb3bfc803a439e566516cf9b63dba6b&ref=null&cv=20240303-6-RELEASE&item-url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1616895/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-origin: https://go.behindthemarkets.com
pragma: no-cache
date: Tue, 05 Mar 2024 03:54:01 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ 35 B
448 B 131ms
131ms XHR
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?version=1.8.6&correlateBy=C6bAEpe4mQF5VBw9WoqEf7&origin=center-js&kind=timer,timer,counter,timer&label=load-center,load-identify,ident-new,send-events&value=124,59.89999961853027,1,416
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:03 GMT
Server: Stargate
Transfer-Encoding: chunked
access-control-max-age: 600
Content-Type: image/gif
access-control-allow-origin: https://go.behindthemarkets.com
X-Forwarded-For: 217.114.215.132
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3i0i7pfj8l800k2e0

GET
H/1.1 200
OK capture Show response
api.leadpages.io/analytics/v1/observations/ Frame 2359 35 B
446 B 131ms
131ms XHR
image/gif 35.192.151.63
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.leadpages.io/analytics/v1/observations/capture?version=1.8.6&correlateBy=hSCohrp4fjQJfvmYsqWSUz&origin=center-js&kind=timer,timer,counter&label=load-center,load-identify,ident-exists&value=118,38.400001525878906,1
Requested by: Host: js.center.io
URL: https://js.center.io/center.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 35.192.151.63 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 63.151.192.35.bc.googleusercontent.com
Software: Stargate /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://btm-btm-btm.lpages.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 03:54:04 GMT
Server: Stargate
Transfer-Encoding: chunked
access-control-max-age: 600
Content-Type: image/gif
access-control-allow-origin: https://btm-btm-btm.lpages.co
X-Forwarded-For: 217.114.215.132
access-control-expose-headers: LP-Security-Token
access-control-allow-credentials: true
Connection: keep-alive
x-request-id: 01o3i0l6o9anrh42g300

GET
H2 204 unip Show response
trc-events.taboola.com/1616895/log/3/ 0
251 B 28ms
28ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1616895/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1709610839658&ver=36&isls=true&src=i&invt=3000&msa=52460&rv=1&tim=1709610844216&vi=1709610839656&ri=edb3bfc803a439e566516cf9b63dba6b&ref=null&cv=20240303-6-RELEASE&item-url=https%3A%2F%2Fgo.behindthemarkets.com%2Flimited-time-offer-4%2F%3F_ef_transaction_id%3Dc23aa525a8ea48c493cb0d529d299ad7%26utm_source%3D96%26utm_campaign%3D529%26utm_medium%3Dmbu12559537%26id%3D%26iocid%3D%26oid%3D1%26aff%3D96&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1616895/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://go.behindthemarkets.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-origin: https://go.behindthemarkets.com
pragma: no-cache
date: Tue, 05 Mar 2024 03:54:04 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

Verdicts & Comments Add Verdict or Comment

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.api.leadpages.io/analytics/v1/events/capture	1970-01-20 18:54:57	Name: view.bb4wMKcXKB896PwqF4vMVT-default-prop.wzjrg5A6gThkzqZo9c3oVh Value: 1709610840000
www.marketbeat.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: avjfo21q2x0uhxnsrsphud3b
js.center.io/	1970-01-21 04:29:30	Name: centerVisitorId Value: tqg9Yh7QgCKkfrgVpoQS45
.behindthemarkets.com/	1970-01-20 21:03:06	Name: _gcl_au Value: 1.1.1894276809.1709610839
.doubleclick.net/	1970-01-21 04:29:30	Name: IDE Value: AHWqTUkP7B73jIkcghghMwLOwQbMIMF7EO9zeZ8jJCbinApwZNjoBLvXSk1ntDE8
.behindthemarkets.com/	1970-01-21 04:29:30	Name: _ga Value: GA1.2.1060397573.1709610840
.behindthemarkets.com/	1970-01-20 18:54:57	Name: _gid Value: GA1.2.500381637.1709610840
.behindthemarkets.com/	1970-01-20 18:53:30	Name: _gat_UA-102395123-1 Value: 1
.behindthemarkets.com/	1970-01-21 04:29:30	Name: _ga_8R6YNFMJ23 Value: GS1.1.1709610839.1.0.1709610839.60.0.0
.criteo.com/	1970-01-21 04:15:06	Name: uid Value: e2bceeea-0a58-4d9c-94cf-4d9bc2129b47
.criteo.com/	1970-01-21 04:15:06	Name: receive-cookie-deprecation Value: 1
.behindthemarkets.com/	1970-01-21 04:22:54	Name: cto_bundle Value: kYE-2V8wUW00SzU1OTdXTm44R3ZCa2dKclBNNm1xTjF5WjFRZHpNMFNVc3VwREtEQUhMZk8xSkRiekZTZlBxZTBYd252UlJPZWpBcnFJMGpxRFFMTXFHdzRUMiUyQnNaT2RZSmpybE1GYnElMkJjZkM2WGMyOXNtNGRKZEdNOHU2dFl4YWZtWHRGVFVMR1NRM1NGZ0czcTVtN2RjODdPNUg2d2UlMkZSME44dCUyQkpOZyUyRnBORnM4JTNE
.media.net/	1970-01-21 03:39:06	Name: visitor-id Value: 3526124408214836000V10
.media.net/	1970-01-20 19:36:42	Name: data-c-ts Value: 1709610840
.media.net/	1970-01-20 19:36:42	Name: data-c Value: k-KwkIoY-fFf72OFWPyweTCe53u4LjUR2FJX8akg~~3
.adnxs.com/	1970-01-20 21:03:06	Name: XANDR_PANID Value: fTCa8jUr41xsZYCiihbXePKK8FkjAh6JSc4A4X6qOry_jubY6LdWQ5WTbj2Ph4kvZ0frNRFi9Kc7wgSzDISLnlLUffAYPlNlGXkVkk62XcQ.
.adnxs.com/	1970-01-21 04:29:30	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 21:03:06	Name: uuid2 Value: 6215474940901846295
.casalemedia.com/	1970-01-21 03:39:06	Name: CMID Value: ZeaXWLmqPJoAAH0FAAzRmAAA
.casalemedia.com/	1970-01-20 21:03:06	Name: CMPS Value: 2123
.casalemedia.com/	1970-01-20 21:03:06	Name: CMPRO Value: 2123
.adnxs.com/	1970-01-20 21:03:06	Name: anj Value: dTM7k!M4/rCxrEQF']wIg2GVHr_w5c!]tbPl@/D!9hy6]/Cr.DgmT>v9t[DFh1uGy2Rkb67Bp(?jcZ.^e:-<p3^/!W^xCsyC2[e9ArSeibpRzqF1`*bafB+?pNu
.demdex.net/	1970-01-20 23:12:42	Name: demdex Value: 68995597866943298443319326121222647807
.omnitagjs.com/	1970-01-20 19:36:42	Name: ayl_visitor Value: a0399c3655512553add708246ed85e34
exchange.mediavine.com/	1970-01-20 19:13:40	Name: mv_tokens Value: %7B%22mv_uuid%22%3A%2200385e90-daa4-11ee-abb3-a16c7755d5c2%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 19:13:40	Name: mv_tokens_eu-v1 Value: %7B%22mv_uuid%22%3A%2200385e90-daa4-11ee-abb3-a16c7755d5c2%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 19:13:40	Name: am_tokens Value: %7B%22mv_uuid%22%3A%2200385e90-daa4-11ee-abb3-a16c7755d5c2%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 19:13:40	Name: am_tokens_eu-v1 Value: %7B%22mv_uuid%22%3A%2200385e90-daa4-11ee-abb3-a16c7755d5c2%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 19:13:40	Name: criteo Value: %7B%22id%22%3A%22k-aAqlmo-fFf72OFWPyweTCe53u4Ji4OdQJLYh8Q%22%2C%22version%22%3A%22criteo%22%7D
.dpm.demdex.net/	1970-01-20 23:12:42	Name: dpm Value: 68995597866943298443319326121222647807
.postrelease.com/	1970-01-21 03:39:06	Name: opt_out Value: 1
.tremorhub.com/	1970-01-21 03:39:27	Name: tvid Value: 58f6353841a142de9edeaeeccd0d98a6
.tremorhub.com/	1970-01-20 19:36:42	Name: tv_UICR Value: k-R2b0VY-fFf72OFWPyweTCe53u4Kg80EEqwUJeQ

55 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://go.behindthemarkets.com/limited-time-offer-4/?_ef_transaction_id=c23aa525a8ea48c493cb0d529d299ad7&utm_source=96&utm_campaign=529&utm_medium=mbu12559537&id=&iocid=&oid=1&aff=96 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.twiago.com
ad.360yield.com
ad.yieldlab.net
analytics.google.com
api.leadpages.io
beacon.krxd.net
btm-btm-btm.lpages.co
cdn.taboola.com
cdnjs.cloudflare.com
cm.adform.net
cm.g.doubleclick.net
contextual.media.net
criteo-partners.tremorhub.com
criteo-sync.teads.tv
dis.criteo.com
dpm.demdex.net
dynamic.criteo.com
e1.emxdgt.com
eb2.3lift.com
embed.lpcontent.net
exchange.mediavine.com
fonts.googleapis.com
fonts.gstatic.com
go.behindthemarkets.com
googleads.g.doubleclick.net
gum.criteo.com
hb.yahoo.net
ib.adnxs.com
id5-sync.com
jadserve.postrelease.com
js.center.io
lh3.googleusercontent.com
match.sharethrough.com
matching.ivitrack.com
mug.criteo.com
pixel.rubiconproject.com
r.casalemedia.com
rtb-csync.smartadserver.com
script.crazyegg.com
simage2.pubmatic.com
sslwidget.criteo.com
static.leadpages.net
stats.g.doubleclick.net
sync-criteo.ads.yieldmo.com
sync-t1.taboola.com
sync.outbrain.com
trc-events.taboola.com
trc.taboola.com
unpkg.com
visitor.omnitagjs.com
widget.us.criteo.com
www.behindthemarkets-btm.com
www.google-analytics.com
www.google.az
www.google.com
www.googletagmanager.com
www.marketbeat.com
x.bidswitch.net
104.18.36.155
13.248.245.213
141.226.228.48
141.95.33.120
142.250.184.226
151.101.1.44
178.250.1.9
185.255.84.153
185.64.191.210
185.89.210.141
2.19.85.30
2.21.22.153
2001:4860:4802:38::15
23.32.185.192
2600:1f18:612b:4200:b1c9:bbe6:9d18:57f1
2606:4700:3108::ac42:2b0e
2606:4700::6810:7aaf
2606:4700::6811:190e
2606:4700::6813:9408
2a00:1450:4001:803::2003
2a00:1450:4001:806::200e
2a00:1450:4001:809::2003
2a00:1450:4001:810::200a
2a00:1450:4001:81c::2001
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:82f::200e
2a00:1450:4001:831::2008
2a00:1450:400c:c02::9c
2a02:2638:3::c
2a02:2638:3::e
2a06:98c1:3121::3
3.122.11.77
34.107.203.240
34.117.157.22
34.251.106.238
35.192.151.63
35.202.21.90
35.214.149.91
37.157.3.20
52.19.180.99
52.210.94.187
52.28.138.244
52.58.90.171
54.73.231.133
63.32.163.40
64.202.112.31
69.173.144.139
74.119.119.150
81.17.55.116
85.215.5.31
95.101.148.20
059bf725c90c5b2f107bdec23a77bd5e6af7bb0de3131164f699536759c7a35d
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d1aad9a434590d1c60dbf3d079df20d70cde2c2afd0c20773c60d0b9cacde9b
0d58b87b0743851392119f2614ac7fdaf1f2b943e5e28f53a9199e10d1cee784
0db972dea92bf7469a431d2820ffb388cff26a3d7be700ee81f2e36ee3974e05
0eb28d90e19b1fd3b42ea09cf5ff871e572e250e3cbf8531036d3c8a69df0cc0
0efa1e4687032588dae8d6d3a00a92e504a3a14b9d1bb23c19670a47c9792110
12ad026eace6494ff61e221807c55802f6c7384c69f79439ff9765c3a3420abc
18242158163fb9c2864cf67400e9e05ba25a96fe25eb39bdb5c9b8c7164991e6
1b98e634435daa1012e8b83a1bb203eceab9742472b45c84ac1d98a729af412d
1c3d93aa96256b957cd33e19601438c7a61d825178ce8147db77598ed1231214
2b9dbc4e3ab31dc403745b54ac6ca7f853ecd69084036b8be7de5a1890ccec49
2d2ef0e9338553c46faa28f8afe6be1e26ebd9dadaf5800642cb56f938857722
2f1dcbe6d55182c8db429872524d1abaaf57a3a91e53cae074f15b366c8c37cf
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
345d333ce5a7d44a9503d94b85abacc393a6d70d0d62da52f7aa96781b0c231e
3684abe518534ed96b6bf7c7b90f54b1fc004ffee736d135aa7ee2eca2b19e63
3ad08651cf80af4f5cee753d0f2aa2bc56f895f5aee2a833b6e674d149a4e072
3c770cf58bc37a49b3bc7e8a8ae53168e3ae6fe8d379bd77395ac37bc9880111
3cf85ecb4a6becc6460dc3e65472ca30c4ea836366cd3d6bd54e315c6f7c31e3
3f8055f98bd55c13f3efe6a6b93109523efba17e3c50ac615dd8c946d6142918
414f94aa5dc74ec228d6aa7f37c1d79db206ff8326ded24a0cded97b75a6dfc5
41845643818a27f792ca43705202c1c9df32214240d3f6682e4d78d2b0a327b0
4348386f343aee8601f19bee98d6dc95b399d554fc5469fb07f2b88b1ed8ed39
4962cbc7e69cb7836432434c2aad9ebbdbc8cde2edd0cd087fb4748f87340757
49b4681fc6a41d10bc9340d077ad5a8e34289092d68d0e8728cca1f9b7d02363
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e10bba92c73c63033b55dd271a5d535b2073d328a780a65df1eeb9714271b7a
4ebd979a9f0a79ff0d1526188ba0b95a5d36751f01fd16d1082779f2d11321b9
52cbcaa92d4379acf9c8d333a4e7a94cf957730870cf8f9137dcb2b14ebb4989
54231de50fe3cec30106fd79a156d8fabebb66dbe7a39de821e2a09705660565
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5590f038f87169772f0bb512d942481838ac73230926fb92c4ff8db9a19b2296
565830745646683f536304cbacfed76d4fa6e783432a5b007a0d777430608731
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
585b5bd39ad329c2c2252aa5728086a1823434f7b37b5f5325a9e96ced2d7171
5a2228ec45f0e70c04e60b4020ed6c5fb327cb05a4ed9073bfcbb5735d9f0b39
5a538b25a98b4c57396b9942d893856f0625144e5b4076b8823c86117fbf50e1
5f20338b9aab2f5f33562eb3b0b23d999896ce426cacd2231b4123510571df4e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c943beb222b0cebaa0c1b47b41dcb6a703ededdba41fe89bb8740041930e186
71947f7827aaada6779268465b7c05db11566497aa661961e86e83fe061a460e
71a0e7af96aa88155f06bb84e8b98a7a1e014b69aac7f0a7ccf5df0feb7066e3
7721ea6e678ff85357eb6c7de4f39681d7b4b53b765ee49d9e45b97bdab68a58
7b59d37480876f27ebc4cddadc46b534b485541a42bdbb6ffb2aa071ea6c74cf
7dae7506dbc59857048b2a8e26109ffd2788cb58ed74cb778d3c73a2db43c0ff
7e2c27b9ba576b52452df883ee0d1e4c2bcf284dd948611e484c1797a5b2ed0d
7f075b3a73dcd21887641aa676692b19deb19825bf0dd925747582e73217aea6
802b0e03789d326a08c22fef2dffdffb8d7691e13f410e7d1d6ce72ac6b765cb
81419462a9aa90c182deca7c5bb642a7e18d7a43a15acbbec36b54390ed9e4ff
88dbe5929f2b6aa111649792d1353e2b5cdad3ddc8bf49350e236fd2b955e514
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8e84fdb2aa9c03cbdca971f812f33cdb5c1f90400b22bce290262601baff8da6
923bb1d333ca289850f06f8c32113212357241945d07ac9d2fc7790a1bdf5f3c
964c07c27ddd7b81974062ffcdbc09b4f2ad97ee417ea7a37f1c8c3fc169971a
99825124b6188062977bfb203c41e7dff1a4aa63c9c0e52ea89d3b519d4a9743
9bda86afc42cb8f1664e0fb4cb87f75a9acb9ce365f0101f475366f61b043dda
9ce7c0c1b56dabf60220a6467217e3601a909ab2c157119fe0a81e5cb58ab683
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
9dd68156eaf50c82fc30619e23e7c8085a0e3b9b9b2095e933dfa8d6a28ac9da
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2f6f72c5e1a1fc0ba5152253acdf2964f42ef2d259d92aa2f4fc63d760b6b6a
a6aa55d33b9fc7dc67c202f272d96d823d92b5094eae463bc04624194b0fbbf1
a7016a7cfb0e637059851e41e784466d87910bf1f733b8fa2a8bf07378bbfe5b
aa305ca6053d5e7b1276bb407d79616830cc4b67509290a105ae265b6dbea225
ae4a2edfd8ead58b477bb9e4bc01815bfeea2f7c7cec8e15d034f48c6c6df67e
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b030865771624c8cac4b1e100f72fb87abc3eccb6c8bedd6a25393a3c6890883
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3656b9eab301548c2ce25ea05db689a2f475a1ef4ce68a09e7aa23d6be6a931
b673e2000e305f8929b4a0f9323169c6a00f5c8c736fbfcde0e6d3626656a5e3
b783f0c504ed0a4be434a29c7ff64e311921553f94ff7c293817c61eef38b8a2
b9cb40fe5555cb856a15c054c364444f99d11229bedf4881082e7e228b86040e
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
beb6e5817e7f1f16be8426abc571e4882ee5bfdbf3d24de63623ca5018d8f7aa
c53fc919da515cc21b389888f6d7a95f69303b518a7f735c11534473f4e2eec7
c73db4ca5a6cf322e5295cea84c2f0cdecb812b1d7998d57bb6528684600e62f
c9dca43fca509197b562e986fd472933428d757daa065972e3c349a7f963856b
cb525f60c933094cb82ec09e748c2958f1e5ace99ebb64c1cbd1aa24e483a9d0
cc08eb3316359de0d8f025efee489da73ca552209a0c9cab6b00894d7fa21d42
cda01a97f7104ba84cff0263d8415554aeb77daf70f5685eaeaad8a24bbba690
d126f9c9e8dd0810f8f2f0073f20041d4ade64615fa368cd72e64430d86d7ef4
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d293ee3cf582df8e9c7a6c090c5ef75bfaf956317e33baa007128e13c51adc8c
d3f4104957e76483acba4180738253208fd8d4d81c64931244860514af502b82
d56ad0781875c34060e15e238f8f8cb621c132675a63e3b90ffe23a2918e4639
d9fe2ac004861df640d03c18ba22aa04ce44c841f4672d65d785791c7f6ce5ce
dd9c7fa4b462f664ef8723720ab8966d964caddb5e2b9c373def1ddb52cb0268
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dff5c7a61358f77654f6f3c48ba16e33a4315bb57389075f380c408b250c73b0
e135acdb3c2c1bd70906af2e93a9b233a3fe05ecbedbd5b2236efdcda7e6faee
e3af0de29249dd8c24fcbd59120cf0d8696ea625ac64904058dd2327e0a027d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e69dd0037f096afd73b3369ef649a7f7209152a79655db386aa6b8c14aec8428
e7d37f66bd7b7ac6eb4f7e0e70d397c6af31c1b0b1cc8a996e3e9bb76c41d0d7
e9d56025d016f39fd1dd58e4de2fd20639a044fa33896f11e94636049ba76545
ebe99412125723327356cad72872052a3664dd5b1af9423fd5b1590eb0bda4bf
ec9e6ee235b7cd2be4c02f7d9d03b70445dbe9c14b5b93422aabc12173d35fd6
ed62884cea0e207677cc0143956e77598ef314edb16c04cab4d57e9b832d49d0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0d96c4ed1e7e05e99cb5779a42e5f3b6055747c51f71c8f36ab6349fac181d9
f4def42dbdc146434a90d9b489e2806f313b4af31f4d36cac96323f8a2bd20d5
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fc589cc734676f9036041dad7ab4909cb483e3e0fb859e53c9ba718eb2b93856
fe92a6eb2f59ce61e06edfb34e917be5138eac63b8097e8587b47931ac41659a
ff98c4cf79d955e494a8d9bf53f00a32ae73717c16628f94f135d865ec0e127b
ff9ce35d5fae856bab207c9f8d8eb3dff6354f007ea9f9b9a32f5cc018d52876

go.behindthemarkets.com Open in urlscan Pro 35.202.21.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

144 Requests

94 %HTTPS

37 %IPv6

47 Domains

58 Subdomains

51 IPs

10 Countries

1106 kBTransfer

3049 kBSize

33 Cookies

2 Outgoing links

Page URL History

Redirected requests

144 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

go.behindthemarkets.com Open in urlscan Pro
35.202.21.90 Public Scan

Screenshot
Live screenshot

Full Image

144
Requests

94 %
HTTPS

37 %
IPv6

47
Domains

58
Subdomains

51
IPs

10
Countries

1106 kB
Transfer

3049 kB
Size

33
Cookies

144 HTTP transactions
0 data transactions