checkout.newsobserver.com Open in urlscan Pro
20.76.203.173 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t1.news.mcclatchydc.com/r/?id=h7011deaa%2Ce10c85a%2Cb8b582c&p1=account.newsobserver.com/subscribe/create?param=f3JBD0A=&...
Effective URL:
https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for...
Submission: On September 27 via api (September 27th 2021, 2:40:51 pm UTC) from US — Scanned from DE

Summary HTTP 122 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 31 IPs in 6 countries across 22 domains to perform 122 HTTP transactions. The main IP is 20.76.203.173, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is checkout.newsobserver.com.
TLS certificate: Issued by Entrust Certification Authority - L1K on August 19th 2020. Valid for: 2 years.

This is the only time checkout.newsobserver.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	35.163.109.214 35.163.109.214	16509 (AMAZON-02) (AMAZON-02)
1 3	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba81	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	20.76.203.173 20.76.203.173	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:810::200d	15169 (GOOGLE) (GOOGLE)
8	107.154.132.193 107.154.132.193	19551 (INCAPSULA) (INCAPSULA)
2	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
7	104.111.219.128 104.111.219.128	16625 (AKAMAI-AS) (AKAMAI-AS)
15	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	3.223.38.51 3.223.38.51	14618 (AMAZON-AES) (AMAZON-AES)
1 2	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
4	52.22.56.164 52.22.56.164	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1 4	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
3	52.214.44.171 52.214.44.171	16509 (AMAZON-02) (AMAZON-02)
1	54.72.70.127 54.72.70.127	() ()
1	15.236.176.210 15.236.176.210	() ()
1 1	34.249.249.121 34.249.249.121	() ()
2	18.203.190.43 18.203.190.43	() ()
1 2	151.101.130.49 151.101.130.49	() ()
1	34.120.253.250 34.120.253.250	() ()
1	34.98.72.95 34.98.72.95	() ()
122	31

1 35.163.109.214 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-163-109-214.us-west-2.compute.amazonaws.com

t1.news.mcclatchydc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00::210:ba81 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

account.newsobserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 20.76.203.173 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

checkout.newsobserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 107.154.132.193 (United States)

ASN19551 (INCAPSULA, US)
PTR: 107.154.132.193.ip.incapdns.net

us1-api.mppglobal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.111.219.128 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-219-128.deploy.static.akamaitechnologies.com

media.mcclatchyinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.223.38.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-38-51.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.22.56.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-56-164.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.214.44.171 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-44-171.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.70.127 (None, )

ASN- ()

mcclatchy.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.236.176.210 (None, )

ASN- ()

mcclatchy.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.249.121 (None, ) 1 redirects

ASN- ()

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.203.190.43 (None, )

ASN- ()

mcclatchy.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.49 (None, ) 1 redirects

ASN- ()

lasteventf-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.253.250 (None, )

ASN- ()

tag.wknd.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.72.95 (None, )

ASN- ()

assets.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	gstatic.com ssl.gstatic.com www.gstatic.com fonts.gstatic.com	1 MB
19	google.com apis.google.com accounts.google.com www.google.com	188 KB
14	newsobserver.com 1 redirects account.newsobserver.com checkout.newsobserver.com media2.newsobserver.com Failed	526 KB
8	mppglobal.com us1-api.mppglobal.com	4 KB
7	mcclatchyinteractive.com media.mcclatchyinteractive.com	459 KB
6	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net pubads.g.doubleclick.net cm.g.doubleclick.net	4 KB
6	matheranalytics.com 1 redirects js.matheranalytics.com www.i.matheranalytics.com	42 KB
4	demdex.net dpm.demdex.net mcclatchy.demdex.net	7 KB
4	stackadapt.com tags.srv.stackadapt.com	6 KB
4	facebook.net connect.facebook.net	249 KB
3	everesttech.net 2 redirects cm.everesttech.net lasteventf-tm.everesttech.net sync-tm.everesttech.net	899 B
3	omtrdc.net mcclatchy.sc.omtrdc.net mcclatchy.tt.omtrdc.net	5 KB
3	google-analytics.com www.google-analytics.com	20 KB
3	qualtrics.com zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com siteintercept.qualtrics.com	22 KB
2	google.de www.google.de	676 B
2	facebook.com www.facebook.com	362 B
1	bounceexchange.com assets.bounceexchange.com	145 KB
1	wknd.ai tag.wknd.ai	5 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	googletagmanager.com www.googletagmanager.com	39 KB
1	mcclatchydc.com 1 redirects t1.news.mcclatchydc.com	713 B
0	rubiconproject.com Failed pixel.rubiconproject.com Failed
122	22

	Domain	Requested by
21	www.gstatic.com	www.google.com www.gstatic.com
15	www.google.com	checkout.newsobserver.com www.gstatic.com www.google.com
11	checkout.newsobserver.com	checkout.newsobserver.com
8	fonts.gstatic.com	www.google.com
8	us1-api.mppglobal.com	checkout.newsobserver.com
7	media.mcclatchyinteractive.com	checkout.newsobserver.com media.mcclatchyinteractive.com
4	www.i.matheranalytics.com
4	tags.srv.stackadapt.com	media.mcclatchyinteractive.com tags.srv.stackadapt.com
4	connect.facebook.net	checkout.newsobserver.com connect.facebook.net media.mcclatchyinteractive.com
3	dpm.demdex.net	media.mcclatchyinteractive.com
3	www.google-analytics.com	media.mcclatchyinteractive.com www.google-analytics.com
3	account.newsobserver.com	1 redirects checkout.newsobserver.com
2	cm.g.doubleclick.net	1 redirects
2	mcclatchy.tt.omtrdc.net	media.mcclatchyinteractive.com
2	pubads.g.doubleclick.net	media.mcclatchyinteractive.com
2	www.google.de
2	siteintercept.qualtrics.com	zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com siteintercept.qualtrics.com
2	js.matheranalytics.com	1 redirects
2	www.facebook.com	connect.facebook.net
2	accounts.google.com	apis.google.com ssl.gstatic.com
2	apis.google.com	checkout.newsobserver.com apis.google.com
1	assets.bounceexchange.com	tag.wknd.ai
1	sync-tm.everesttech.net	1 redirects
1	tag.wknd.ai	media.mcclatchyinteractive.com
1	lasteventf-tm.everesttech.net	media.mcclatchyinteractive.com
1	cm.everesttech.net	1 redirects
1	mcclatchy.sc.omtrdc.net	media.mcclatchyinteractive.com
1	mcclatchy.demdex.net	media.mcclatchyinteractive.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.googleadservices.com	www.googletagmanager.com
1	zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com	media.mcclatchyinteractive.com
1	www.googletagmanager.com	media.mcclatchyinteractive.com
1	ssl.gstatic.com	accounts.google.com
1	t1.news.mcclatchydc.com	1 redirects
0	pixel.rubiconproject.com Failed
0	media2.newsobserver.com Failed	media.mcclatchyinteractive.com
122	37

This site contains links to these domains. Also see Links.

Domain
www.newsobserver.com
account.newsobserver.com

Subject Issuer	Validity	Valid
checkout.mcclatchydc.com Entrust Certification Authority - L1K	`2020-08-19` - `2022-09-13`	2 years	crt.sh
*.apis.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-07` - `2021-10-05`	3 months	crt.sh
news.bellinghamherald.com DigiCert ECC Extended Validation Server CA	`2020-08-24` - `2022-08-24`	2 years	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-09-10` - `2022-03-11`	6 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
www.mcclatchydc.com DigiCert SHA2 Secure Server CA	`2021-06-23` - `2022-02-01`	7 months	crt.sh
www.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.qualtrics.com DigiCert SHA2 Secure Server CA	`2020-10-26` - `2021-11-26`	a year	crt.sh
*.srv.stackadapt.com Amazon	`2020-12-09` - `2022-01-07`	a year	crt.sh
js.matheranalytics.com Sectigo RSA Domain Validation Secure Server CA	`2021-03-19` - `2022-04-19`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
www.i.matheranalytics.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-28` - `2022-01-27`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2020-10-29` - `2021-11-29`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
tag.wknd.ai R3	`2021-09-24` - `2021-12-23`	3 months	crt.sh
assets.bounceexchange.com GTS CA 1D4	`2021-08-29` - `2021-11-27`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Frame ID: 9B5C8C06104E5BCBE1CF3393ED9C7C06
Requests: 71 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: C757D08BF39485DF38B1E42187B6135E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=aq98i260shg5
Frame ID: ED8002FF3945DB9C9C73788D09364981
Requests: 7 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=ph45tu4evhxa
Frame ID: 6BE7A0EB5F9B040BDB376A8E34D318D3
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=n9983ab58l46
Frame ID: 42099B321FF09DACC1991D43ABB7A896
Requests: 7 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu
Frame ID: B174FC825CFD0D6FAC8CA0857A46C99F
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j
Frame ID: 37D1869C36A876004B8657F1309CE8B8
Requests: 9 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f
Frame ID: 89078BF540BDCF59934BE74CE15DBCDE
Requests: 9 HTTP requests in this frame

Frame: https://mcclatchy.demdex.net/dest5.html?d_nsid=0
Frame ID: 5D6E163823EE033B1F09EC26FBDDE589
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

News and Observer

Page URL History Show full URLs

https://t1.news.mcclatchydc.com/r/?id=h7011deaa%2Ce10c85a%2Cb8b582c&p1=account.newsobserver.com/subscribe/cr... HTTP 302
https://account.newsobserver.com/subscribe/create?param=f3JBD0A=&ac_cid=DM537973&ac_bid=1880219306&offer=NmEf... HTTP 302
https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-... Page URL

Detected technologies

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

122
Requests

96 %
HTTPS

44 %
IPv6

22
Domains

37
Subdomains

31
IPs

6
Countries

2992 kB
Transfer

7006 kB
Size

26
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.newsobserver.com/

Search URL Search Domain Scan URL

URL: http://www.newsobserver.com/customer-service/contact-us/
Title: CONTACT US

Search URL Search Domain Scan URL

URL: https://account.newsobserver.com/digital-access
Title: Set up digital access

Search URL Search Domain Scan URL

URL: https://account.newsobserver.com/reset-password
Title: Forgot password?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t1.news.mcclatchydc.com/r/?id=h7011deaa%2Ce10c85a%2Cb8b582c&p1=account.newsobserver.com/subscribe/create?param=f3JBD0A=&offer=NmEfaxcUb3lSCUJAfRI5DDM0fw5ICEc4Bg9CG15QPgoUG0hQeHNFCkdAb29STx0HLisVS1BIbxExdUtLAAxDdD1DeHpJGw8%3D&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&p2=DM537973&p3=1880219306&s=Guh8LWC0Q3SV0vJbcFcqdBuCsdfx_xbC4VAo5PIEPCU HTTP 302
https://account.newsobserver.com/subscribe/create?param=f3JBD0A=&ac_cid=DM537973&ac_bid=1880219306&offer=NmEfaxcUb3lSCUJAfRI5DDM0fw5ICEc4Bg9CG15QPgoUG0hQeHNFCkdAb29STx0HLisVS1BIbxExdUtLAAxDdD1DeHpJGw8%3D&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109 HTTP 302
https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 59

https://js.matheranalytics.com/s/ma12095/74930332/all/ml.js?cb=1575 HTTP 301
https://js.matheranalytics.com/static/ltm/ma12095/all/6/ml.br.js

Request Chain 108

https://cm.everesttech.net/cm/dd?d_uuid=70314594767869883180093165486877820337 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVHX8wAAAEtb0AQE

Request Chain 113

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NzAzMTQ1OTQ3Njc4Njk4ODMxODAwOTMxNjU0ODY4Nzc4MjAzMzc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDwZk1rS7q9wFACfdBNuldE&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 116

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVZIWDh3QUFBRXRiMEFRRQ==

Request Chain 120

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YVHX8wAAAEtb0AQE&expires=90

122 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
checkout.newsobserver.com/apps/payment/
Redirect Chain

https://t1.news.mcclatchydc.com/r/?id=h7011deaa%2Ce10c85a%2Cb8b582c&p1=account.newsobserver.com/subscribe/create?param=f3JBD0A=&offer=NmEfaxcUb3lSCUJAfRI5DDM0fw5ICEc4Bg9CG15QPgoUG0hQeHNFCkdAb29STx0...
https://account.newsobserver.com/subscribe/create?param=f3JBD0A=&ac_cid=DM537973&ac_bid=1880219306&offer=NmEfaxcUb3lSCUJAfRI5DDM0fw5ICEc4Bg9CG15QPgoUG0hQeHNFCkdAb29STx0HLisVS1BIbxExdUtLAAxDdD1DeHpJ...
https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109

2 KB
1 KB

548ms
15ms

Document
text/html

20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e83d4103d5a08ee59708b55d4bf32e1c8cf7579deff6f80cbcad67b1048bdedf

Request headers

:method: GET
:authority: checkout.newsobserver.com
:scheme: https
:path: /apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

content-type: text/html
content-encoding: gzip
last-modified: Mon, 28 Jun 2021 16:07:02 GMT
accept-ranges: bytes
etag: "0978ba1376cd71:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Mon, 27 Sep 2021 14:40:47 GMT
content-length: 992

Redirect headers

x-powered-by: Express
x-env: prod
content-security-policy: frame-ancestors eedition.newsobserver.com
cache-control: public, max-age=900, unique
expires: Mon, 27 Sep 2021 14:55:46 GMT
location: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109#/?guid=6963486fd12e4c2da4d7267eb8579132
content-type: text/html; charset=utf-8
content-length: 416
date: Mon, 27 Sep 2021 14:40:46 GMT
x-frame-options: DENY
set-cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=; Domain=.newsobserver.com; Path=/; Expires=Mon, 27 Sep 2021 16:40:46 GMT; Max-Age=7200; HttpOnly

GET
H2 200 main.min.css
checkout.newsobserver.com/css/ 206 KB
34 KB 16ms
16ms Stylesheet
text/css 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/css/main.min.css
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7462356b4d60b272317657dfd4ffbfa221d3387d863a4f86751664623a645363

Request headers

:path: /css/main.min.css
pragma: no-cache
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
content-encoding: gzip
last-modified: Mon, 28 Jun 2021 16:07:06 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "0f1eda3376cd71:0"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 34728

GET
H2 200 all.js Show response
checkout.newsobserver.com/apps/payment/js/ 799 KB
207 KB 27ms
27ms Script
application/javascript 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 34c2d21f4739dfe70913b840b2cf1971109fb912d62b476f65270d75393ec22c

Request headers

:path: /apps/payment/js/all.js
pragma: no-cache
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
content-encoding: gzip
last-modified: Mon, 28 Jun 2021 16:07:42 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "01b63b9376cd71:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 211781

GET
H2 200 platform.js Show response
apis.google.com/js/ 52 KB
21 KB 55ms
30ms Script
application/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js?onload=onLoadGoogleCallback

Requested by

Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84e8111d0e249e7c77bdc68dbb26edbf9c6a6b1499489ee9309c04b54e4c091

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-c+RCdvxD3FFSZ8MA+MizhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "16748d131f7a786214356810826b23c6"
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt"}]}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-c+RCdvxD3FFSZ8MA+MizhA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt"
expires: Mon, 27 Sep 2021 14:40:47 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 24ms
7ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8396a04c9c0c0fcca7cb3cfd84ea991182df2d1074dbfc1562d50fa47af70592

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: PVv5LUJiR4sxfW6f2oi+Bg==
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: 4SDhf2Fa9oYApL9T+IslFpH63++Ch4L08DpflEFgIECXm2XLnoL+qtT+mNSln7HJwYUMnQ3sq32BcyI8E1+w9w==
x-fb-trip-id: 917726464
x-fb-content-md5: 361f5f4f0c37322da196eb50c83ada78
x-frame-options: DENY
date: Mon, 27 Sep 2021 14:40:47 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "5102d778396e0ee7afa6f0cc69107a07"
timing-allow-origin: *
expires: Mon, 27 Sep 2021 14:50:27 GMT

GET
H2 200 locale-en-us.json Show response
checkout.newsobserver.com/modules/mpp/_core/locale/ 28 KB
28 KB 15ms
14ms XHR
application/json 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/modules/mpp/_core/locale/locale-en-us.json
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d1b4c569f8b58b11ecb29e62c57bc3e90d41e097e5afdbb25398fe8ec57070e9

Request headers

:path: /modules/mpp/_core/locale/locale-en-us.json
pragma: no-cache
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: application/json, text/plain, */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept: application/json, text/plain, */*
Referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
last-modified: Mon, 28 Jun 2021 16:06:52 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "0b6959b376cd71:0"
content-type: application/json
accept-ranges: bytes
content-length: 28925

GET
H2 200 mpp Show response
account.newsobserver.com/api/configs/ 450 B
1 KB 474ms
459ms XHR
application/json 2a02:26f0:6c00::210:ba81
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/api/configs/mpp

Requested by

Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba81 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/ Express

Resource Hash

df5c2c0aba6821732a4f4e71875e3a4a24d1d2e5ee3a25c5d0b44b7a5a8ee9f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors eedition.newsobserver.com
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: frame-ancestors eedition.newsobserver.com
x-env: prod
x-powered-by: Express
etag: W/"1c2-XiUKAnMgi3JqEF5nBg0krBcu4ec"
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: public, max-age=900, unique
date: Mon, 27 Sep 2021 14:40:47 GMT
content-length: 450
expires: Mon, 27 Sep 2021 14:55:47 GMT

GET
H2 200 logo.svg
checkout.newsobserver.com/images/newsobserver/ 5 KB
5 KB 17ms
17ms Image
image/svg+xml 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://checkout.newsobserver.com/images/newsobserver/logo.svg
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1270a862b7759b86d679ce76254e22bcd758959c10543bd38d451a9ef6c38004

Request headers

:path: /images/newsobserver/logo.svg
pragma: no-cache
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
last-modified: Mon, 28 Jun 2021 16:07:10 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "04b50a6376cd71:0"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 5241

GET
H2 200 mcclatchy-sans-semi.woff
checkout.newsobserver.com/fonts/mcclatchy/ 29 KB
29 KB 15ms
15ms Font
font/x-woff 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/mcclatchy/mcclatchy-sans-semi.woff
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 21891543f19b0f6f617591cd5b4624a09f0d74d01b3e9836bca0af56ddea6973

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
:path: /fonts/mcclatchy/mcclatchy-sans-semi.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
last-modified: Mon, 28 Jun 2021 16:06:50 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "089649a376cd71:0"
content-type: font/x-woff
accept-ranges: bytes
content-length: 29264

GET
H2 200 mcclatchy-sans-regular.woff
checkout.newsobserver.com/fonts/mcclatchy/ 29 KB
29 KB 14ms
14ms Font
font/x-woff 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/mcclatchy/mcclatchy-sans-regular.woff
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7ddc1f3125c1c3c3e6cb0422f65eedddac57fc4716d5a88e4c947b0065a8ae95

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
:path: /fonts/mcclatchy/mcclatchy-sans-regular.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
last-modified: Mon, 28 Jun 2021 16:06:50 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "089649a376cd71:0"
content-type: font/x-woff
accept-ranges: bytes
content-length: 29244

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 268 KB
76 KB 23ms
8ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=07a7ef74915a68505f607f79bd540c3b

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fa1082f8ca5c3c5a9638f0f020cfdfa2acfe5c428da851467795170e2440fef9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://checkout.newsobserver.com/
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: YARl5hjrTXTGIdlAFQBdww==
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 77587
x-fb-rlafr: 0
x-fb-debug: VQGgOHSPxGPOeB6eqKeRS2vxyar8vsLerullUZ7tsLZnNES8vpozlyafXHiIomfzh3tJ7KePL/waEVsOBOfdIQ==
x-fb-trip-id: 917726464
x-fb-content-md5: 4a2d9bcb61cbaff402a40b12bae64fed
x-frame-options: DENY
date: Mon, 27 Sep 2021 14:40:47 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "ce4d92328477f8fc0639410196a43b02"
timing-allow-origin: *
expires: Tue, 27 Sep 2022 12:46:48 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/ 103 KB
35 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?onload=onLoadGoogleCallback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51809bc55f512c21a3829627405dfec8796820392303908a9e011691de6f79f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 20:41:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 496730
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34990
x-xss-protection: 0
last-modified: Fri, 10 Sep 2021 23:24:10 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="social-frontend-mpm-access"
expires: Wed, 21 Sep 2022 20:41:57 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame C757 513 B
924 B 75ms
24ms Document
text/html 2a00:1450:4001:810::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7152ee0c49420d49c94a0d91cedafb4747835e0679cfeab4b640e28d719f257b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-V13Jmp+mXgNZrJ4mTrNsRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:47 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-V13Jmp+mXgNZrJ4mTrNsRw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

OPTIONS
H2 200 VerifyActiveSession
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ Frame 0
0 563ms
494ms Preflight 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VerifyActiveSession
Protocol: H2
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-sessionid,x-tokenid
Origin: https://checkout.newsobserver.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: private
server: Microsoft-IIS/10.0
x-stackifyid: V2|c59bbf0a-c5bd-422b-83f5-dba456e2aa4a|C65747|CD71
access-control-allow-origin: https://checkout.newsobserver.com
access-control-request-method: POST,OPTIONS
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
access-control-expose-headers: X-SessionId
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 27 Sep 2021 14:40:48 GMT
content-length: 0
x-cdn: Imperva
x-iinfo: 5-32915137-32915138 NNNN CT(119 243 0) RT(1632753647384 0) q(0 0 4 0) r(5 5) U5

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 53ms
37ms Fetch
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=234351110366085&input_token&origin=1&redirect_uri=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2F%3Fguid%3D6963486fd12e4c2da4d7267eb8579132&sdk=joey&wants_cookie_data=true

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=07a7ef74915a68505f607f79bd540c3b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com;frame-src *.facebook.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: J/TEdx+elhwycFV4ML9CX4DLb0v4+oj56sDkRLIDpuutALiSHwuxthogIcwQtScm3xxmGvL8hugmUQSuoeXnBw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 27 Sep 2021 14:40:47 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://checkout.newsobserver.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 VerifyActiveSession Show response
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ 89 B
554 B 181ms
180ms XHR
application/json 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VerifyActiveSession
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2f8c3c6d1db89f53ba1b8dc6a66c5fb7658b90222ae7d679324fbdb652d417e3

Request headers

Accept: application/json, text/plain, */*
X-SessionId: 6963486fd12e4c2da4d7267eb8579132
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
X-TokenId: F9934CD9F14F4D2DA511CD602875FBC9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:48 GMT
access-control-request-method: POST,OPTIONS
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
x-iinfo: 5-32915214-32915215 NNYY CT(120 244 0) RT(1632753647882 0) q(0 0 0 0) r(2 2) U5
access-control-expose-headers: X-SessionId
x-stackifyid: V2|2e279a0f-a013-42f5-869d-dc9abbf8ecfc|C65747|CD71
x-cdn: Imperva
content-encoding: gzip
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
cache-control: private

GET
H2 200 1751795023-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame C757 115 KB
40 KB 74ms
14ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/1751795023-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

387e8b5019922c28cdc230b2cb4eb495b498aa0457bba42eb16d690e36773942

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 12:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92838
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40255
x-xss-protection: 0
last-modified: Fri, 17 Sep 2021 04:14:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="federated-signon-mpm-access"
expires: Mon, 26 Sep 2022 12:53:29 GMT

GET
H2 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame C757 14 B
172 B 24ms
24ms XHR
application/json 2a00:1450:4001:810::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fcheckout.newsobserver.com&client_id=938840581902-f6t7asf26ag15v9aca1lfo6hu9d486b1.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/1751795023-idpiframe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
X-Requested-With: XmlHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 27 Sep 2021 15:40:47 GMT

OPTIONS
H2 200 GetConfiguration
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ Frame 0
0 131ms
131ms Preflight 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/GetConfiguration
Protocol: H2
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-sessionid,x-tokenid
Origin: https://checkout.newsobserver.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: private
server: Microsoft-IIS/10.0
x-stackifyid: V2|3290e12e-a6d9-42c7-9adb-69eaf1fe90e9|C65747|CD71
access-control-allow-origin: https://checkout.newsobserver.com
access-control-request-method: POST,OPTIONS
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
access-control-expose-headers: X-SessionId
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 27 Sep 2021 14:40:48 GMT
content-length: 0
x-cdn: Imperva
x-iinfo: 5-32915242-32915243 NNNY CT(120 242 0) RT(1632753648063 0) q(0 0 0 0) r(1 1) U5

POST
H2 200 GetConfiguration Show response
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ 4 KB
2 KB 383ms
383ms XHR
application/json 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/GetConfiguration
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b9387b04310ec91bcec39955cca94fd387b1d66ab822733a6f713df6e61c8b23

Request headers

Accept: application/json, text/plain, */*
X-SessionId: 6963486fd12e4c2da4d7267eb8579132
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
X-TokenId: F9934CD9F14F4D2DA511CD602875FBC9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:48 GMT
access-control-request-method: POST,OPTIONS
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
x-iinfo: 5-32915263-32915264 NNYY CT(120 241 0) RT(1632753648197 0) q(0 0 0 0) r(4 4) U5
access-control-expose-headers: X-SessionId
x-stackifyid: V2|eaf70d81-4a99-4d95-9f9e-be72a6c24fa4|C65747|CD70
x-cdn: Imperva
content-encoding: gzip
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
cache-control: private

OPTIONS
H2 200 VerifyActiveSession
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ Frame 0
0 141ms
141ms Preflight 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VerifyActiveSession
Protocol: H2
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-sessionid,x-tokenid
Origin: https://checkout.newsobserver.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: private
server: Microsoft-IIS/10.0
x-stackifyid: V2|38844e17-67d6-48ef-b0e4-34d96eef0b96|C65747|CD70
access-control-allow-origin: https://checkout.newsobserver.com
access-control-request-method: POST,OPTIONS
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
access-control-expose-headers: X-SessionId
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 27 Sep 2021 14:40:48 GMT
content-length: 0
x-cdn: Imperva
x-iinfo: 5-32915311-32915312 NNNY CT(119 241 0) RT(1632753648596 0) q(0 0 0 0) r(2 2) U5

GET
H2 200 mpp Show response
account.newsobserver.com/api/configs/ 450 B
1 KB 363ms
362ms XHR
application/json 2a02:26f0:6c00::210:ba81
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/api/configs/mpp

Requested by

Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba81 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/ Express

Resource Hash

df5c2c0aba6821732a4f4e71875e3a4a24d1d2e5ee3a25c5d0b44b7a5a8ee9f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors eedition.newsobserver.com
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: frame-ancestors eedition.newsobserver.com
x-env: prod
x-powered-by: Express
etag: W/"1c2-XiUKAnMgi3JqEF5nBg0krBcu4ec"
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: public, max-age=900, unique
date: Mon, 27 Sep 2021 14:40:49 GMT
content-length: 450
expires: Mon, 27 Sep 2021 14:55:49 GMT

POST
H2 200 VerifyActiveSession Show response
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ 89 B
528 B 517ms
516ms XHR
application/json 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VerifyActiveSession
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9cb4461317e9e6ceb9f0d5caead26d22f0ecb04de4652ec3310f0cef340dfc4b

Request headers

Accept: application/json, text/plain, */*
X-SessionId: 6963486fd12e4c2da4d7267eb8579132
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
X-TokenId: F9934CD9F14F4D2DA511CD602875FBC9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:48 GMT
access-control-request-method: POST,OPTIONS
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
x-iinfo: 5-32915329-32915330 NNYN CT(117 241 0) RT(1632753648726 0) q(0 0 3 0) r(5 5) U5
access-control-expose-headers: X-SessionId
x-stackifyid: V2|77edafb2-e6b2-4e1a-8c6b-2c5fce3454fb|C65747|CD72
x-cdn: Imperva
content-encoding: gzip
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
cache-control: private

OPTIONS
H2 200 VoucherInfo
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ Frame 0
0 131ms
130ms Preflight 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VoucherInfo
Protocol: H2
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-sessionid,x-tokenid
Origin: https://checkout.newsobserver.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: private
server: Microsoft-IIS/10.0
x-stackifyid: V2|717aae4f-63c3-442f-b6d5-c87a5585e4cc|C65747|CD69
access-control-allow-origin: https://checkout.newsobserver.com
access-control-request-method: POST,OPTIONS
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
access-control-expose-headers: X-SessionId
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 27 Sep 2021 14:40:49 GMT
content-length: 0
x-cdn: Imperva
x-iinfo: 5-32915428-32915429 NNNY CT(119 243 0) RT(1632753649293 0) q(0 0 0 0) r(2 2) U5

GET
H/1.1 200
OK newsobserver.js Show response
media.mcclatchyinteractive.com/misites/nao/ 2 KB
3 KB 244ms
138ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 18f9e6b96e326a7aa705c687fc8893c6b2df53acce477aefe2d0239d7b82fcb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:49 GMT
Last-Modified: Sun, 29 Apr 2018 21:38:27 GMT
Server: Apache
ETag: "9f8-56b038eb73ac0"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2552

GET
H/1.1 200
OK mpp_s_code.js Show response
media.mcclatchyinteractive.com/mistats/vendors/ 94 KB
94 KB 258ms
152ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1cc5573434bc9b7f1f814fa8ec4014b19334c45b6711b67fd55ea00ebb1427ac

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:49 GMT
Last-Modified: Tue, 31 Aug 2021 18:56:14 GMT
Server: Apache
ETag: "17823-5cadf80fcf9d2"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 96291

GET
H/1.1 200
OK mpp.js Show response
media.mcclatchyinteractive.com/mistats/vendors/ 76 KB
76 KB 271ms
150ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c221b3da72f02e13bb4448c744da4d4125a5c69142cb0f41d69bebe0c9c0c8dd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:49 GMT
Last-Modified: Mon, 27 Sep 2021 14:40:03 GMT
Server: Apache
ETag: "12f01-5ccfb12840d7b"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 77569

GET
H/1.1 200
OK finalizestats.js Show response
media.mcclatchyinteractive.com/mistats/ 60 KB
60 KB 269ms
149ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9b9661d9e08e91d45ab439abc3e516d809cedcac6cf4254716d40c8fae3a74c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:49 GMT
Last-Modified: Wed, 08 Sep 2021 18:37:54 GMT
Server: Apache
ETag: "f0d9-5cb802e2f1416"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 61657

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 915 B
1013 B 40ms
16ms Script
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=vcRecaptchaApiLoaded&render=explicit

Requested by

Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

35aba1fa92af31c456fcae1d5ff5bad246f7856c4f3b3ab742cb99d64357a486

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 579
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:49 GMT

POST
H2 200 VoucherInfo Show response
us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/ 699 B
820 B 189ms
189ms XHR
application/json 107.154.132.193
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://us1-api.mppglobal.com/interface/Mpp/eDeveloper/v8/eDeveloper.json.svc/VoucherInfo
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/apps/payment/js/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.132.193 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.132.193.ip.incapdns.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 95315f38b7443633802f5f6b7838553762350dc909f6a9038185042923c7dc34

Request headers

Accept: application/json, text/plain, */*
X-SessionId: 6963486fd12e4c2da4d7267eb8579132
Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
X-TokenId: F9934CD9F14F4D2DA511CD602875FBC9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
access-control-request-method: POST,OPTIONS
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://checkout.newsobserver.com
x-iinfo: 5-32915448-32915449 NNYY CT(119 240 0) RT(1632753649424 0) q(0 0 0 0) r(2 2) U5
access-control-expose-headers: X-SessionId
x-stackifyid: V2|e2ef33d8-7ad7-4a73-9b87-7ee497a05e5e|C65747|CD69
x-cdn: Imperva
content-encoding: gzip
access-control-allow-headers: X-SessionId,X-TokenId,Accept,Content-Type,x-requested-with
cache-control: private

GET
H2 200 mcclatchy-sans-bold.woff
checkout.newsobserver.com/fonts/mcclatchy/ 28 KB
28 KB 17ms
14ms Font
font/x-woff 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/mcclatchy/mcclatchy-sans-bold.woff
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: cce3d886a2dac25f1992bbcb994e3bd9b9c3aa5984cc418080af148ea3246d14

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=; G_ENABLED_IDPS=google
:path: /fonts/mcclatchy/mcclatchy-sans-bold.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
last-modified: Mon, 28 Jun 2021 16:06:50 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "089649a376cd71:0"
content-type: font/x-woff
accept-ranges: bytes
content-length: 28768

GET
H2 200 fa-solid-900.woff2
checkout.newsobserver.com/fonts/fontawesome/ 74 KB
74 KB 22ms
20ms Font
application/font-woff2 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/fontawesome/fa-solid-900.woff2
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=; G_ENABLED_IDPS=google
:path: /fonts/fontawesome/fa-solid-900.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
last-modified: Mon, 28 Jun 2021 16:07:06 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "0f1eda3376cd71:0"
content-type: application/font-woff2
accept-ranges: bytes
content-length: 76084

GET
H2 200 fa-regular-400.woff2
checkout.newsobserver.com/fonts/fontawesome/ 13 KB
13 KB 26ms
25ms Font
application/font-woff2 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/fontawesome/fa-regular-400.woff2
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 86e496b536b26ba60cdb68df9dd9143b19a63b65e30e373b0321833aab1295d6

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=; G_ENABLED_IDPS=google
:path: /fonts/fontawesome/fa-regular-400.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
last-modified: Mon, 28 Jun 2021 16:07:02 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "0978ba1376cd71:0"
content-type: application/font-woff2
accept-ranges: bytes
content-length: 13576

GET
H2 200 fa-brands-400.woff2
checkout.newsobserver.com/fonts/fontawesome/ 74 KB
74 KB 28ms
26ms Font
application/font-woff2 20.76.203.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://checkout.newsobserver.com/fonts/fontawesome/fa-brands-400.woff2
Requested by: Host: checkout.newsobserver.com
URL: https://checkout.newsobserver.com/css/main.min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.76.203.173 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 8e4560c16c7970efa47680450b2cf239d4a482c056d308acea12bb9022906c8b

Request headers

sec-fetch-mode: cors
origin: https://checkout.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: ak_bmsc=098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=; G_ENABLED_IDPS=google
:path: /fonts/fontawesome/fa-brands-400.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: checkout.newsobserver.com
referer: https://checkout.newsobserver.com/css/main.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://checkout.newsobserver.com/css/main.min.css
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:49 GMT
last-modified: Mon, 28 Jun 2021 16:07:02 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "0978ba1376cd71:0"
content-type: application/font-woff2
accept-ranges: bytes
content-length: 75936

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ 342 KB
134 KB 56ms
14ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=vcRecaptchaApiLoaded&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://checkout.newsobserver.com/
Origin: https://checkout.newsobserver.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame ED80 40 KB
21 KB 26ms
24ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=aq98i260shg5

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

153979cf61d1e2a8b808c144bd78bf2acc35f5ed0a9df200f271403cee07bd2e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Uj9j+lLHvwU52M5GYEcPhw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=aq98i260shg5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-Uj9j+lLHvwU52M5GYEcPhw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20930
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 6BE7 40 KB
21 KB 32ms
32ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0c942013fed8950f66f8d02f0a0e710a3b9edbcb404852aa89e28d517ba292d3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TiJRtgvllmv5Y7ljQlpeLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=ph45tu4evhxa
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-TiJRtgvllmv5Y7ljQlpeLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 21001
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 4209 40 KB
21 KB 41ms
41ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f0bb1418067db6f87b117bac092942db1ac59941666282df6d4d2898a65b4d2c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lQrPIUs3nra0ZykbMrBMUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=n9983ab58l46
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-lQrPIUs3nra0ZykbMrBMUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20923
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame ED80 52 KB
26 KB 52ms
16ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=aq98i260shg5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame ED80 342 KB
134 KB 70ms
35ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 6BE7 52 KB
25 KB 66ms
31ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 6BE7 342 KB
134 KB 73ms
38ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H/1.1 200
OK common.js Show response
media.mcclatchyinteractive.com/misites/all/ 4 KB
4 KB 139ms
139ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/misites/all/common.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec2cc99b7d1be6fb64d9ce3622e5584e39002529d87a71ffad76435b800de309

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:50 GMT
Last-Modified: Tue, 10 Sep 2019 13:27:05 GMT
Server: Apache
ETag: "ee5-59232dc43bc40"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3813

GET
H/1.1 200
OK micb.js Show response
media.mcclatchyinteractive.com/mistats/ 129 KB
130 KB 418ms
381ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/micb.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 003ee5a6d6c34ac5b8d8a5a30d3005d851d1ed86097e6833f3d1139e3927267a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:50 GMT
Last-Modified: Thu, 02 Sep 2021 11:53:53 GMT
Server: Apache
ETag: "2054b-5cb01d63b8e45"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 132427

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 4209 52 KB
25 KB 48ms
25ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 4209 342 KB
134 KB 63ms
41ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H2 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame ED80 2 KB
2 KB 14ms
14ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:54:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 13605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Mon, 04 Oct 2021 10:54:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame ED80 15 KB
15 KB 67ms
23ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 09:07:47 GMT
x-content-type-options: nosniff
age: 538383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 09:07:47 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame ED80 15 KB
16 KB 57ms
14ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:50:25 GMT
x-content-type-options: nosniff
age: 13825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 27 Sep 2022 10:50:25 GMT

GET
H2 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 4209 2 KB
2 KB 13ms
13ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:54:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 13605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Mon, 04 Oct 2021 10:54:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 4209 15 KB
15 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 09:07:47 GMT
x-content-type-options: nosniff
age: 538383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 09:07:47 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 4209 15 KB
15 KB 16ms
16ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:50:25 GMT
x-content-type-options: nosniff
age: 13825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 27 Sep 2022 10:50:25 GMT

GET
H2 200 webworker.js
www.google.com/recaptcha/api2/ Frame ED80 102 B
204 B 16ms
16ms Other
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

392ed442867566d8cbd08f7e0d9a379c49177a9c96186ad0d1eba1a316721267

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=aq98i260shg5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H2 200 webworker.js
www.google.com/recaptcha/api2/ Frame 6BE7 102 B
178 B 20ms
19ms Other
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

392ed442867566d8cbd08f7e0d9a379c49177a9c96186ad0d1eba1a316721267

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=ph45tu4evhxa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H2 200 webworker.js
www.google.com/recaptcha/api2/ Frame 4209 102 B
178 B 16ms
16ms Other
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

392ed442867566d8cbd08f7e0d9a379c49177a9c96186ad0d1eba1a316721267

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&co=aHR0cHM6Ly9jaGVja291dC5uZXdzb2JzZXJ2ZXIuY29tOjQ0Mw..&hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&size=invisible&cb=n9983ab58l46
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET micb.js
media2.newsobserver.com/newsobserver/ 0
0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ab43cf929d649dba8ce38c92dec4849c8049b678fec9942ae08df5ca57757280

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25969
x-xss-protection: 0
pragma: public
x-fb-debug: IehlAqIuh6v8X8fGjyHZMhURuPDfAfwPkrkHTzQbt2k0Sr7O1vSF8aiR3ja/KWUc1xgB4hrFdA5Ud8KAEgbpZw==
x-fb-trip-id: 917726464
x-frame-options: DENY
date: Mon, 27 Sep 2021 14:40:50 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
39 KB 64ms
27ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848620132

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

daccba7f51292ba5909197ba9204303ad6c7d826af2f02bb21beaea69d2bfdb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39190
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H2 200 / Show response
zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 7 KB
4 KB 76ms
38ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_e4ggyW07IMID52Z

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

f19dc5236e8103e0dd9a481921ed628531f6bfaf4fd1eb750db2c18d5822415f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 396189
cf-polished: origSize=8383
edge-control: max-age=604800
x-envoy-upstream-service-time: 5
vary: Accept-Encoding
timing-allow-origin: *
cf-bgj: minify
server: cloudflare
x-powered-by: Express
etag: W/"20bf-H8r6Aj2Yc9j3jt0iWh77Y2QBbnM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
cf-ray: 69557d4a4a184007-CDG
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 436ms
111ms Script
text/javascript 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: bfcb3e50985adb6ff0658907b867d93113fb072efb3233f2482463cf833e08a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 27 Sep 2021 14:40:50 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4438
Connection: keep-alive
Content-Type: text/javascript

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma12095/all/6/
Redirect Chain

https://js.matheranalytics.com/s/ma12095/74930332/all/ml.js?cb=1575
https://js.matheranalytics.com/static/ltm/ma12095/all/6/ml.br.js

140 KB
41 KB

8ms
8ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma12095/all/6/ml.br.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5a36bfb7995c90e80bc907138d7f0dd0193ea597c39e0e2a03825456b108c5d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 18:20:09 GMT
content-encoding: br
last-modified: Thu, 15 Jul 2021 21:18:49 GMT
server: nginx
age: 73241
etag: "20650b71c4c2f963c8608629cb2edbdb"
vary: Accept-Encoding
x-cache: HIT Thu, 15 Jul 2021 21:29:09 GMT
content-type: application/x-javascript
via: 1.1 google
cache-control: public,max-age=3600
alt-svc: clear
content-length: 41736

Redirect headers

date: Mon, 27 Sep 2021 14:40:50 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma12095/all/6/ml.br.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 4-gc-euw1-10924

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 50ms
13ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 6530
date: Mon, 27 Sep 2021 12:52:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 27 Sep 2021 14:52:00 GMT

GET
H2 200 bframe Show response
www.google.com/recaptcha/api2/ Frame B174 7 KB
1 KB 19ms
19ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

056e3666b4858c7f69afe4b9fc1f884f55c99e91606cde853e76509b9dd2e38d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oAMasKuKLHNlrxgmo+i+MQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-oAMasKuKLHNlrxgmo+i+MQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1113
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 37D1 7 KB
1 KB 19ms
18ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

efd19dfec4bcda76629c1a8f02bbe3163e5018bc26eae676b24bd0153e739eb5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oLY3S7qMOg5q4oe5Ejrf/A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-oLY3S7qMOg5q4oe5Ejrf/A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1112
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 8907 7 KB
1 KB 23ms
22ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c324557a4b9d514997074f610710ebfa75f6c047db6ac1d6f5d620e8e7145b96

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zt3SePw0+j6DWctnvZVQvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://checkout.newsobserver.com/
accept-encoding: gzip, deflate, br
cookie: NID=511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 27 Sep 2021 14:40:50 GMT
content-security-policy: script-src 'report-sample' 'nonce-zt3SePw0+j6DWctnvZVQvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1113
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 11.b48251b2521bf5ae5dfb.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 55 KB
17 KB 33ms
32ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/11.b48251b2521bf5ae5dfb.chunk.js?Q_CLIENTVERSION=1.61.0&Q_CLIENTTYPE=web&Q_BRANDID=checkout.newsobserver.com

Requested by

Host: zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com
URL: https://zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_e4ggyW07IMID52Z

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

0688987cf82d39f8dd72117fa3b5e7422fb59a2ca7256ab77209c0d541944904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 396916
cf-polished: origSize=57116
cf-ray: 69557d4bfcfe4007-CDG
edge-control: max-age=604800
x-envoy-upstream-service-time: 7
vary: Accept-Encoding
last-modified: Wed, 22 Sep 2021 18:25:26 GMT
server: cloudflare
x-powered-by: Express
etag: W/"df1c-17c0ec15df0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-bgj: minify

GET
H2 200 1081709588515684 Show response
connect.facebook.net/signals/config/ 491 KB
144 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1081709588515684?v=2.9.46&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5bd6464d825962c78212f6b36e884c48b3f2c3dd030d8b8df5760ecc59a0b55b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 147292
x-xss-protection: 0
pragma: public
x-fb-debug: I11Q/G+r+Fmzr/aSW3foeeBfe9YzDixLpVn773QzLVwIoyVmy5botTLCYeU7gEPrpK5yFBy6/VTN5H1D5RnBCQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 27 Sep 2021 14:40:50 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
216 B 21ms
20ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=2140297821&t=pageview&_s=1&dl=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&dh=checkout.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Login%20Or%20Register&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YFDAAAABCAAAAC~&jid=558856260&gjid=1827732836&cid=748618885.1632753651&tid=UA-48279682-1&_gid=2081093665.1632753651&_r=1&_slc=1&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd14=%23%2FloginOrRegister&cd15=%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&cg1=News%20and%20Observer&cg2=MPP&z=359992854

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 21ms
20ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=2140297821&t=pageview&_s=1&dl=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&dh=checkout.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Login%20Or%20Register&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YFDAAAABCAAAAC~&jid=1151936430&gjid=396782574&cid=748618885.1632753651&tid=UA-48280268-1&_gid=2081093665.1632753651&_r=1&_slc=1&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd14=%23%2FloginOrRegister&cd15=%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&cg1=News%20and%20Observer&cg2=MPP&z=30687456

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
14 KB 80ms
21ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848620132

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

3b843d8505c200af17cdbf0a534faf3a5e6d41e67068387787984470ea717c97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14160
x-xss-protection: 0
server: cafe
etag: 14207842493151788310
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame B174 52 KB
25 KB 13ms
13ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 214
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame B174 342 KB
134 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 37D1 52 KB
25 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 214
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 37D1 342 KB
134 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 8907 52 KB
25 KB 22ms
22ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:37:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 214
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:37:16 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/ Frame 8907 342 KB
134 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136719
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 18:01:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 14:10:18 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 425ms
102ms Image
image/gif 52.22.56.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=News%20and%20Observer&tv=js-3.0.134&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=6&tvcfg=all&tid=ec251860-4dff-475a-b9a8-bee2daa5a638&pid=882a0191-b14c-4e52-8f0c-a7eaa91211ae&dtm=1632753650653&qnm=_matherq&visible=1&tabid=0abb89b1-9d62-45df-90c7-9546fe2de063&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&vp=1600x1200&ds=1600x1200&tofa=1632753651&vid=1&lvidt=1632753651&duid=e61af215c2f10cf0&fp=560948675&cid=ma12095&mrk=74930332&cx=eyJhY3Rpb24iOnsidHlwZSI6InN1YnNjcmlwdGlvbiIsImNhdGVnb3J5IjoicGF5bWVudCIsImFjdGlvbiI6InN1YnNjcmlwdGlvbl9zdGFydGVkIiwiZmxvd3JlZiI6eyJkYXkwIjp7ImZsb3ciOiJzdWJzY3JpcHRpb24iLCJ0aWQiOiJlYzI1MTg2MC00ZGZmLTQ3NWEtYjlhOC1iZWUyZGFhNWE2MzgiLCJ0aW1lIjoiMTYzMjc1MzY1MSJ9LCJkYXk1Ijp7InRpbWUiOiIxNjMyNzUzNjUxIn0sImRheTMwIjp7InRpbWUiOiIxNjMyNzUzNjUxIn19fSwicGVyZiI6eyJzdGFydCI6IjE2MzI3NTM2NDQ3MTUiLCJyZWRpckNudCI6IjAiLCJuYXZUeXBlIjoibGluayIsImhlYXBVIjoiMzkuNm1iIiwiaGVhcFQiOiI1My41bWIiLCJmc3RQYWludCI6IjI0MjkiLCJmZXRjaFMiOiIxODIwIiwiZG9tYWluUyI6IjIzMjEiLCJkb21haW5FIjoiMjMyMSIsImNvbm5TIjoiMjMyMSIsImNvbm5FIjoiMjM1MyIsInNzbFMiOiIyMzI3IiwicmVxdVMiOiIyMzU0IiwicmVzcFMiOiIyMzY4IiwicmVzcEUiOiIyMzY5IiwiZG9tTG9hZCI6IjIzNzIiLCJkb21JbnRlciI6IjI0NzkiLCJkb21Mb2FkUyI6IjI0ODAiLCJkb21Mb2FkRSI6IjI1MDUiLCJkb21DbXBsdCI6IjI1OTEiLCJsb2FkUyI6IjI1OTEiLCJsb2FkRSI6IjI1OTMifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiI3NDg2MTg4ODUiLCJyZWZUaW1lIjoiMTYzMjc1MzY1MDY1MiJ9XX0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.56.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-56-164.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 3 KB
1 KB 136ms
136ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_e4ggyW07IMID52Z&Q_CLIENTVERSION=1.61.0&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/11.b48251b2521bf5ae5dfb.chunk.js?Q_CLIENTVERSION=1.61.0&Q_CLIENTTYPE=web&Q_BRANDID=checkout.newsobserver.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac5557f0b22983a696a6c891d0081a4f31ed4e0e09727c01ce0a86c05df07868

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
trace-id: 83a62816ad8740e0
cf-ray: 69557d4cee624007-CDG
vary: Accept-Encoding

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
470 B 67ms
21ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-48279682-1&cid=748618885.1632753651&jid=558856260&gjid=1827732836&_gid=2081093665.1632753651&_u=YFDAAAAACAAAAC~&z=936778740

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 27 Sep 2021 14:40:50 GMT
content-type: text/plain
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
362 B 8ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1081709588515684&ev=PageView&dl=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&rl=&if=false&ts=1632753650732&sw=1600&sh=1200&v=2.9.46&r=stable&ec=0&o=30&fbp=fb.1.1632753650731.873798728&it=1632753650609&coo=false&exp=p0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 65 B
292 B 103ms
103ms Stylesheet
text/css 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: fd605d875d563aad8e8646a01b7058f136b6e011afee6d9b6755d40d699c4ada

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 27 Sep 2021 14:40:50 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 65
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 420ms
112ms Fetch
image/jpeg 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 27 Sep 2021 14:40:51 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
283 B 33ms
32ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-48279682-1&cid=748618885.1632753651&jid=558856260&_u=YFDAAAAACAAAAC~&z=604496894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 97ms
60ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-48279682-1&cid=748618885.1632753651&jid=558856260&_u=YFDAAAAACAAAAC~&z=604496894

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848620132/ 2 KB
2 KB 66ms
27ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848620132/?random=1632753650799&cv=9&fst=1632753650799&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9m0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&tiba=News%20and%20Observer&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01f65052f71042de2ab0bf5fd9369c34616c55bb136c5c6d9d3ad04d80d98221

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1129
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 reload Show response
www.google.com/recaptcha/api2/ Frame 37D1 35 KB
21 KB 45ms
45ms XHR
application/json 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c813c425e94940f8d5969ad279d87087c465249b40838bf4050dc35ee2bd89b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=rhagc33tg59j
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21184
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

POST
H2 200 reload Show response
www.google.com/recaptcha/api2/ Frame B174 35 KB
21 KB 42ms
41ms XHR
application/json 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

54896675b7106c6b98177ba7d084ceba5f47ed591eb393286a7a65f6bdb185ad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=eq6fvvsyejiu
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21241
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

POST
H2 200 reload Show response
www.google.com/recaptcha/api2/ Frame 8907 35 KB
21 KB 50ms
49ms XHR
application/json 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9573e6cd85da47a78444a5b75524918441848898e3424a81a47421e59d478166

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/bframe?hl=de&v=tftmXwdbgCvrXiHxr5HGbIaL&k=6Le-ZWcUAAAAAMx5K4JYlIDQaPU7B3fRJN0Epa4P&cb=4lghiruq9g7f
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Mon, 27 Sep 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21299
x-xss-protection: 1; mode=block
expires: Mon, 27 Sep 2021 14:40:50 GMT

GET
H2 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 37D1 600 B
688 B 15ms
14ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 14:23:42 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 87428
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 600
x-xss-protection: 0
expires: Sun, 03 Oct 2021 14:23:42 GMT

GET
H2 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 37D1 530 B
620 B 15ms
15ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 15:09:16 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 603094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 530
x-xss-protection: 0
expires: Mon, 27 Sep 2021 15:09:16 GMT

GET
H2 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 37D1 665 B
754 B 15ms
15ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 11:05:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 12902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 665
x-xss-protection: 0
expires: Mon, 04 Oct 2021 11:05:48 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 37D1 15 KB
15 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:50:25 GMT
x-content-type-options: nosniff
age: 13825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 27 Sep 2022 10:50:25 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 37D1 15 KB
15 KB 16ms
16ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 09:07:47 GMT
x-content-type-options: nosniff
age: 538383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 09:07:47 GMT

GET
H2 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 8907 600 B
657 B 14ms
14ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 14:23:42 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 87428
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 600
x-xss-protection: 0
expires: Sun, 03 Oct 2021 14:23:42 GMT

GET
H2 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 8907 530 B
587 B 15ms
14ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 15:09:16 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 603094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 530
x-xss-protection: 0
expires: Mon, 27 Sep 2021 15:09:16 GMT

GET
H2 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 8907 665 B
722 B 15ms
14ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 11:05:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 12902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 665
x-xss-protection: 0
expires: Mon, 04 Oct 2021 11:05:48 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 8907 15 KB
15 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:50:25 GMT
x-content-type-options: nosniff
age: 13825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 27 Sep 2022 10:50:25 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 8907 15 KB
15 KB 16ms
15ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 09:07:47 GMT
x-content-type-options: nosniff
age: 538383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 09:07:47 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/848620132/ 42 B
138 B 25ms
24ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848620132/?random=1632753650799&cv=9&fst=1632751200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9m0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&tiba=News%20and%20Observer&async=1&fmt=3&is_vtc=1&random=3761535819&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/848620132/ 42 B
154 B 26ms
26ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/848620132/?random=1632753650799&cv=9&fst=1632751200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9m0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109&tiba=News%20and%20Observer&async=1&fmt=3&is_vtc=1&random=3761535819&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pts Show response
pubads.g.doubleclick.net/subopt/ 149 B
368 B 100ms
76ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/pts?products=newsobserver.com&type=general&extrainfo=null&u_tz=0&v=1&cdm=checkout.newsobserver.com&c=350388

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

c9a19a60288cb8fcdc282ec2b9e73745e52d6e1f7ab4d48836c6b0db75cae129

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124
x-xss-protection: 0
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 27 Sep 2021 14:40:51 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
2 KB 212ms
40ms XHR
application/json 52.214.44.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1632753651004

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.214.44.171 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-44-171.eu-west-1.compute.amazonaws.com

Software

Resource Hash

380dbf2e9d1a28e9b2e7999c8a9adfe91b26f97b8f8e532872005452f1269389

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v018-092446e54.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: ZhxDrqy2Q+w=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://checkout.newsobserver.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1000
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET mpp_s_code.js
media2.newsobserver.com/newsobserver/vendors/ 0
0

GET
H/1.1 200
OK at_2.3.js Show response
media.mcclatchyinteractive.com/mistats/ 91 KB
92 KB 142ms
142ms Script
application/javascript 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b8a2fbd39f5894181c5d653f15572a9bc48297d6b5fe7826d28f2c485a229001

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Last-Modified: Thu, 01 Oct 2020 14:36:12 GMT
Server: Apache
ETag: "16cfb-5b09cf0080f00"
Vary: Origin
Content-Type: application/javascript
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 93435

GET
H2 204 data Show response
pubads.g.doubleclick.net/subopt/ 0
603 B 78ms
64ms XHR
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/data?events=newsobserver.com%3Apayment_flow_start&extrainfo=null&u_tz=0&v=1&cdm=checkout.newsobserver.com&c=282944

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 14:40:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: https://checkout.newsobserver.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 102ms
102ms Image
image/gif 52.22.56.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=News%20and%20Observer&tv=js-3.0.134&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=6&tvcfg=all&tid=3cca54d8-7304-42f2-9672-47a2fec9a122&pid=882a0191-b14c-4e52-8f0c-a7eaa91211ae&dtm=1632753650687&qnm=_matherq&visible=1&tabid=0abb89b1-9d62-45df-90c7-9546fe2de063&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&vp=1600x1200&ds=1600x1200&tofa=1632753651&vid=1&lvidt=1632753651&duid=e61af215c2f10cf0&fp=560948675&cid=ma12095&mrk=74930332&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJwYXltZW50IiwiYWN0aW9uIjoic3Vic2NyaXB0aW9uX3NlbGVjdGVkIiwib2ZmZXJzIjpbeyJvZmZlck5hbWUiOiJVTkxJTUlURUQgRElHSVRBTCBBQ0NFU1MiLCJwcmljZSI6IjAuOTkifV0sInR5cGUiOiJzdWJzY3JpcHRpb24iLCJmbG93cmVmIjp7ImRheTAiOnsiZmxvdyI6InN1YnNjcmlwdGlvbiIsInRpZCI6ImVjMjUxODYwLTRkZmYtNDc1YS1iOWE4LWJlZTJkYWE1YTYzOCIsInRpbWUiOiIxNjMyNzUzNjUxIn0sImRheTUiOnsidGltZSI6IjE2MzI3NTM2NTEifSwiZGF5MzAiOnsidGltZSI6IjE2MzI3NTM2NTEifX19LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6Ijc0ODYxODg4NSIsInJlZlRpbWUiOiIxNjMyNzUzNjUwNjg2In1dfQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.56.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-56-164.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
452 B 107ms
106ms XHR
text/plain 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=hXFHelqg_0qGLqDaoIkgLQ&is_js=true&landing_url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&t=News%20and%20Observer&host=https://checkout.newsobserver.com&sa_conv_data_css_value=%20%220-bd7ccfb6-9cfc-492d-7f29-6bbabc3813f8%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd966606be94efa46765dde9e01a60e1e87b9e817b7
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: 0ecaf1ce9b0ffdc9b0c4d90c685ea025673e26adc0a2ce6c00cccd9ccba32227

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://checkout.newsobserver.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 138

GET
H/1.1 200
OK dest5.html Show response
mcclatchy.demdex.net/ Frame 5D6E 7 KB
3 KB 151ms
56ms Document
text/html 54.72.70.127

General

Check archive.org

Show headers Download Go to

Full URL

https://mcclatchy.demdex.net/dest5.html?d_nsid=0

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.72.70.127 -, , ASN (),

Reverse DNS

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: mcclatchy.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://checkout.newsobserver.com/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=70314594767869883180093165486877820337
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Mon, 27 Sep 2021 14:40:51 GMT
DCS: dcs-prod-irl1-2-v018-0140b2bc2.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 23 Sep 2021 12:09:25 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: ka/oKjGeR0s=
Content-Length: 2791
Connection: keep-alive

GET
H2 200 id Show response
mcclatchy.sc.omtrdc.net/ 2 B
324 B 70ms
17ms XHR
application/x-javascript 15.236.176.210

General

Check archive.org

Show headers Download Go to

Full URL

https://mcclatchy.sc.omtrdc.net/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&mid=70104469372516891290113754370197172742&ts=1632753651225

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 -, , ASN (),

Reverse DNS

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 27 Sep 2021 14:40:51 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-567564d5d5-vbqjd
vary: Origin
x-c: main-1531.I2ae8be.M0-520
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://checkout.newsobserver.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YVHX8wAAAEtb0AQE
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=70314594767869883180093165486877820337
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVHX8wAAAEtb0AQE

42 B
945 B

44ms
44ms

Image
image/gif

52.214.44.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVHX8wAAAEtb0AQE

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.214.44.171 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-44-171.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v018-0b11b7be7.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: W/vgK2VIS1Q=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVHX8wAAAEtb0AQE
Date: Mon, 27 Sep 2021 14:40:51 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 99ms
99ms Image
image/gif 52.22.56.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=News%20and%20Observer&tv=js-3.0.134&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=6&tvcfg=all&tid=eb18fb6e-0112-48f4-9620-b3aa0b24a318&pid=882a0191-b14c-4e52-8f0c-a7eaa91211ae&dtm=1632753650690&qnm=_matherq&visible=1&tabid=0abb89b1-9d62-45df-90c7-9546fe2de063&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&vp=1600x1200&ds=1600x1200&tofa=1632753651&vid=1&lvidt=1632753651&duid=e61af215c2f10cf0&fp=560948675&cid=ma12095&mrk=74930332&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJyZWdpc3RyYXRpb24iLCJhY3Rpb24iOiJjcmVhdGVkIiwidHlwZSI6InN1YnNjcmlwdGlvbiIsImZsb3dyZWYiOnsiZGF5MCI6eyJmbG93Ijoic3Vic2NyaXB0aW9uIiwidGlkIjoiZWMyNTE4NjAtNGRmZi00NzVhLWI5YTgtYmVlMmRhYTVhNjM4IiwidGltZSI6IjE2MzI3NTM2NTEifSwiZGF5NSI6eyJ0aW1lIjoiMTYzMjc1MzY1MSJ9LCJkYXkzMCI6eyJ0aW1lIjoiMTYzMjc1MzY1MSJ9fX0sImlkZW50aXRpZXMiOlt7InR5cGUiOiJnYSIsImlkIjoiNzQ4NjE4ODg1IiwicmVmVGltZSI6IjE2MzI3NTM2NTA2OTAifV19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.56.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-56-164.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

POST
H2 200 delivery Show response
mcclatchy.tt.omtrdc.net/rest/v1/ 256 B
499 B 213ms
55ms XHR
application/json 18.203.190.43

General

Check archive.org

Show headers Download Go to

Full URL: https://mcclatchy.tt.omtrdc.net/rest/v1/delivery?client=mcclatchy&sessionId=e6a88eba0d4a4491af4fd5f315f82b11&version=2.3.0
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.190.43 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04284ac55adbfdb96d6243d00fb2919abd40e9623eff85d0c426503acb196560

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://checkout.newsobserver.com
date: Mon, 27 Sep 2021 14:40:51 GMT
content-encoding: gzip
access-control-allow-credentials: true
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id: 5520bde99f0ae3e097455bc855320407
content-type: application/json;charset=UTF-8

POST
H2 200 delivery Show response
mcclatchy.tt.omtrdc.net/rest/v1/ 33 KB
4 KB 213ms
57ms XHR
application/json 18.203.190.43

General

Check archive.org

Show headers Download Go to

Full URL: https://mcclatchy.tt.omtrdc.net/rest/v1/delivery?client=mcclatchy&sessionId=e6a88eba0d4a4491af4fd5f315f82b11&version=2.3.0
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.190.43 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d08e946f4033fc38f58ef7a2f24a3ce4fa759f357ffaafec352e03a927558f08

Request headers

Referer: https://checkout.newsobserver.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://checkout.newsobserver.com
date: Mon, 27 Sep 2021 14:40:51 GMT
content-encoding: gzip
access-control-allow-credentials: true
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id: c914ec8a7b17a6f588b223ad2752ec0d
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 103ms
103ms Image
image/gif 52.22.56.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=News%20and%20Observer&sec=MPP&prem=0&ptype=Other&auth=News%7CObserver%20%3A%20MPP&tv=js-3.0.134&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=6&tvcfg=all&tid=71adea79-b267-4709-8a8b-62e1e839e515&pid=882a0191-b14c-4e52-8f0c-a7eaa91211ae&dtm=1632753650693&qnm=_matherq&visible=1&tabid=0abb89b1-9d62-45df-90c7-9546fe2de063&url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister&vp=1600x1200&ds=1600x1200&tofa=1632753651&vid=1&lvidt=1632753651&duid=e61af215c2f10cf0&fp=560948675&cid=ma12095&mrk=74930332&cx=eyJjYXRlZ29yeSI6eyJjYXRlZ29yaWVzIjpbWyJPbmxpbmV8UmVnaXN0cmF0aW9ufHx8Il1dfSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiI3NDg2MTg4ODUiLCJyZWZUaW1lIjoiMTYzMjc1MzY1MDY5MyJ9XX0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.56.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-56-164.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 14:40:51 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEDwZk1rS7q9wFACfdBNuldE&google_cver=1
dpm.demdex.net/ Frame 5D6E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NzAzMTQ1OTQ3Njc4Njk4ODMxODAwOTMxNjU0ODY4Nzc4MjAzMzc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDwZk1rS7q9wFACfdBNuldE&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

42ms
42ms

Image
image/gif

52.214.44.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDwZk1rS7q9wFACfdBNuldE&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.214.44.171 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-44-171.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-05b42b657.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: jvgWVIxTS3Q=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDwZk1rS7q9wFACfdBNuldE&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
lasteventf-tm.everesttech.net/ 0
214 B 39ms
7ms XHR
text/plain 151.101.130.49

General

Check archive.org

Show headers Download Go to

Full URL: https://lasteventf-tm.everesttech.net/?_les_imsOrgId=3B6E35F15A82BBB00A495D91@AdobeOrg&_les_sdid=0A71255795CFCC90-05C8F849DED3683B&_les_last_search_click=&_les_rsid=mccltallmcclatchy&_les_mid=70104469372516891290113754370197172742&_les_url=https%3A%2F%2Fcheckout.newsobserver.com%2Fapps%2Fpayment%2F%3Fac_cid%3DDM537973%26ac_bid%3D1880219306%26cid%3Deml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109%23%2FloginOrRegister
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 -, , ASN (),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:40:51 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1632753652.577939,VS0,VE0
x-cache: MISS
content-type: text/plain
access-control-allow-origin: https://checkout.newsobserver.com
access-control-allow-credentials: true
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn4075-HHN

GET
H2 200 i.js Show response
tag.wknd.ai/3581/ 15 KB
5 KB 60ms
8ms Script
text/plain 34.120.253.250

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/3581/i.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 -, , ASN (),
Reverse DNS
Software: fasthttp /
Resource Hash: 872962a39642df646762f1901ad135e2def759171f1dd12e40c38cb89b906015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:36:39 GMT
content-encoding: gzip
server: fasthttp
age: 252
etag: 330eb4079e6b15
content-type: text/plain; charset=utf-8
via: 1.1 google
cache-control: public,max-age=60
x-region: us-central1
timing-allow-origin: *
alt-svc: clear
content-length: 4450
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://pix.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5D6E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVZIWDh3QUFBRXRiMEFRRQ==

170 B
243 B

20ms
19ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVZIWDh3QUFBRXRiMEFRRQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 14:40:51 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1632753652.588806,VS0,VE0
x-served-by: cache-hhn4075-HHN
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVZIWDh3QUFBRXRiMEFRRQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 ijs_all_modules_cjs_min_186b5bb83572f94b598be849ceea196f.js
assets.bounceexchange.com/assets/smart-tag/versioned/ 583 KB
145 KB 58ms
9ms Script
text/javascript 34.98.72.95

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_186b5bb83572f94b598be849ceea196f.js
Requested by: Host: tag.wknd.ai
URL: https://tag.wknd.ai/3581/i.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://checkout.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 14:23:14 GMT
content-encoding: gzip
age: 260257
x-guploader-uploadid: ADPycduvUgfdLTo9vdWJYisf4y3d6mrJ_3jU0ErUf3Y_LWJnyJjYdcnX3LX5Sof8ff8FxC66aQHIb-C8i1zkdFkKYY4
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 147700
last-modified: Fri, 24 Sep 2021 14:23:03 GMT
server: UploadServer
etag: "5b8f803ea4354e3008720120dd5c295a"
vary: Accept-Encoding
x-goog-hash: crc32c=sGFk3g==, md5=W4+APqQ1TjAIcgEg3VwpWg==
x-goog-generation: 1632493383863557
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 147700
accept-ranges: bytes
content-type: text/javascript
expires: Sat, 24 Sep 2022 14:23:14 GMT

GET id
dpm.demdex.net/ 0
0

POST s01901273572438
mcclatchy.sc.omtrdc.net/b/ss/mccltallmcclatchy/10/JS-2.22.0/ 0
0

GET

tap.php
pixel.rubiconproject.com/ Frame 5D6E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YVHX8wAAAEtb0AQE&expires=90

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: media2.newsobserver.com
URL: https://media2.newsobserver.com/newsobserver/micb.js

Domain: media2.newsobserver.com
URL: https://media2.newsobserver.com/newsobserver/vendors/mpp_s_code.js

Domain: dpm.demdex.net
URL: https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&d_nsid=0&d_mid=70104469372516891290113754370197172742&d_coop_safe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=mcid%0170104469372516891290113754370197172742&ts=1632753651654

Domain: mcclatchy.sc.omtrdc.net
URL: https://mcclatchy.sc.omtrdc.net/b/ss/mccltallmcclatchy/10/JS-2.22.0/s01901273572438

Domain: pixel.rubiconproject.com
URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YVHX8wAAAEtb0AQE&expires=90

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 01:51:45	Name: _GRECAPTCHA Value: 09AH-MKGVdDYYJLcUHf0pxAH7X33UXovjShir3QBPIW8aJnwc_TpLjHFb7SxIf4KrCk0zRhsl5vHQWdXhLiULv2_s
.mcclatchydc.com/	1970-02-13 18:03:57	Name: uuid230 Value: 67cc407a-7839-46c6-87be-9b0e8f2df3b9
.mcclatchydc.com/	1969-12-31 23:59:59	Name: nlid Value: 7011deaa\|e10c85a
.newsobserver.com/	1970-01-19 21:32:40	Name: ak_bmsc Value: 098D4C70F222F91DAEAC699F22936E28~000000000000000000000000000000~YAAQfboQAraBtuV7AQAAvnuzJw3/IQ8trImEz5tBh5ua4+kp9C65hnQdRo7BaugDnLDXLpJrc0usRTafMcJE1WVeiXT7j57ZE64Sy+WO7K/4MFdEboe+mASr3FQEWla/rE0IVZvcSY0n7migyd1VzKGpPhwsxqfYbR0n8SxS82lNL6Wu0V2WE551QuHfXkAxs7ildbRIy3DAwyGQryTsbvc+/2nR1ruwAiqw5EsVQuSW76f7JdVkyKLn676+OgAjtY2B3FPji/S2fVqSjtjXEtUlsAMNW2EF/oKmAinv86OaCHnCQ7Hx241aNqYPpGlV3I8CVy+Yt5eaAyJgGvvlYMD8LdM0wZVMZL1LsnfXdk2xyPs75263pufdKiY+HI08kMyojVP2bsR3DI1qJxA5GjXSYLMwm2U=
.google.com/	1970-01-20 01:56:04	Name: NID Value: 511=IxXjxow8BZidi68exRCzzbXhyyFtdOj1QdyMaq0qwlsopR5COO9c1TRc4j5xhTA9oVgUSl8UxgwqNGYMl4GjlYrOrVxI66w6mL3Hb9Fg2rXpJ7vXNPVWb4hgwTJsQkkSHmPR3UjcbzUgBnqYHxK-zbshcYOm6nSIVcDjnClz194
.checkout.newsobserver.com/	1978-01-11 21:30:57	Name: G_ENABLED_IDPS Value: google
.newsobserver.com/	1970-01-19 21:32:37	Name: mi_pwp Value: MPP%3A%20UNLIMITED%20DIGITAL%20ACCESS%7C0.99
.checkout.newsobserver.com/	1970-01-20 15:03:45	Name: _ga Value: GA1.3.748618885.1632753651
.checkout.newsobserver.com/	1970-01-19 21:34:00	Name: _gid Value: GA1.3.2081093665.1632753651
.checkout.newsobserver.com/	1970-01-19 21:32:33	Name: _gat_mistats_ga_UA-48279682-1 Value: 1
.checkout.newsobserver.com/	1970-01-19 21:32:33	Name: _gat_mistats_ga_UA-48280268-1 Value: 1
.newsobserver.com/	1970-01-19 23:42:09	Name: _gcl_au Value: 1.1.199677098.1632753651
.newsobserver.com/	1970-01-19 21:32:35	Name: _sp_flow.1b7f Value: subscription
.newsobserver.com/	1970-01-20 15:03:45	Name: _sp_id.1b7f Value: e61af215c2f10cf0.1632753651.1.1632753651.1632753651
.newsobserver.com/	1970-01-19 21:32:35	Name: _sp_ses.1b7f Value: *
tags.srv.stackadapt.com/	1970-01-20 06:18:09	Name: sa-user-id Value: s%3A0-bd7ccfb6-9cfc-492d-7f29-6bbabc3813f8.Ln%2BHzRTquTqhRUV1fplr7vB%2F0mGg14uaYiR2cSo8Atk
.srv.stackadapt.com/	1970-01-20 06:18:09	Name: sa-user-id-v2 Value: s%3A0-bd7ccfb6-9cfc-492d-7f29-6bbabc3813f8%24ip%24185.232.23.183.DGzcFkvSc%2F2axWTwt%2FYO0bJm7PSn3hRENMBkwS7A84g
.newsobserver.com/	1970-01-19 23:42:09	Name: _fbp Value: fb.1.1632753650731.873798728
.facebook.com/	1970-01-19 23:42:09	Name: fr Value: 02DIK6OEJ9ibSygi1..BhUdfy...1.0.BhUdfy.
.doubleclick.net/	1970-01-19 21:32:34	Name: test_cookie Value: CheckForPermission
.newsobserver.com/	1970-01-19 21:32:35	Name: mi_gps Value: 4
.demdex.net/	1970-01-20 01:51:45	Name: demdex Value: 70314594767869883180093165486877820337
.newsobserver.com/	1969-12-31 23:59:59	Name: AMCVS_3B6E35F15A82BBB00A495D91%40AdobeOrg Value: 1
.newsobserver.com/	1970-01-20 15:03:45	Name: AMCV_3B6E35F15A82BBB00A495D91%40AdobeOrg Value: -1124106680%7CMCIDTS%7C18898%7CMCMID%7C70104469372516891290113754370197172742%7CMCAAMLH-1633358451%7C6%7CMCAAMB-1633358451%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1632760851s%7CNONE%7CvVersion%7C5.2.0
.newsobserver.com/	1969-12-31 23:59:59	Name: at_check Value: true
.newsobserver.com/	1970-01-19 21:32:35	Name: mbox Value: session#e6a88eba0d4a4491af4fd5f315f82b11#1632755512

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://checkout.newsobserver.com/apps/payment/?ac_cid=DM537973&ac_bid=1880219306&cid=eml_ret_.99mo-3mo-15.99-flash-sale-wk40-3for3_202109#/?guid=6963486fd12e4c2da4d7267eb8579132(Line 8) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/cb=gapi.loaded_0(Line 277) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/cb=gapi.loaded_0(Line 277) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 286) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 286) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 286) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 250) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 250) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 96) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 96) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://www.gstatic.com/recaptcha/releases/tftmXwdbgCvrXiHxr5HGbIaL/recaptcha__de.js(Line 96) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://media.mcclatchyinteractive.com/mistats/micb.js(Line 834) Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.
security	error	URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_186b5bb83572f94b598be849ceea196f.js Message: The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.newsobserver.com
accounts.google.com
apis.google.com
assets.bounceexchange.com
checkout.newsobserver.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
dpm.demdex.net
fonts.gstatic.com
googleads.g.doubleclick.net
js.matheranalytics.com
lasteventf-tm.everesttech.net
mcclatchy.demdex.net
mcclatchy.sc.omtrdc.net
mcclatchy.tt.omtrdc.net
media.mcclatchyinteractive.com
media2.newsobserver.com
pixel.rubiconproject.com
pubads.g.doubleclick.net
siteintercept.qualtrics.com
ssl.gstatic.com
stats.g.doubleclick.net
sync-tm.everesttech.net
t1.news.mcclatchydc.com
tag.wknd.ai
tags.srv.stackadapt.com
us1-api.mppglobal.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.i.matheranalytics.com
zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com
dpm.demdex.net
mcclatchy.sc.omtrdc.net
media2.newsobserver.com
pixel.rubiconproject.com
104.111.219.128
104.17.209.240
107.154.132.193
107.178.250.234
142.250.184.194
142.250.186.34
15.236.176.210
151.101.130.49
18.203.190.43
20.76.203.173
2a00:1450:4001:80e::2002
2a00:1450:4001:810::200d
2a00:1450:4001:811::2003
2a00:1450:4001:827::2003
2a00:1450:4001:827::2004
2a00:1450:4001:828::2003
2a00:1450:4001:828::200e
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2003
2a00:1450:4001:831::2008
2a00:1450:400c:c08::9c
2a02:26f0:6c00::210:ba81
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.223.38.51
34.120.253.250
34.249.249.121
34.98.72.95
35.163.109.214
52.214.44.171
52.22.56.164
54.72.70.127
003ee5a6d6c34ac5b8d8a5a30d3005d851d1ed86097e6833f3d1139e3927267a
01f65052f71042de2ab0bf5fd9369c34616c55bb136c5c6d9d3ad04d80d98221
04284ac55adbfdb96d6243d00fb2919abd40e9623eff85d0c426503acb196560
056e3666b4858c7f69afe4b9fc1f884f55c99e91606cde853e76509b9dd2e38d
0688987cf82d39f8dd72117fa3b5e7422fb59a2ca7256ab77209c0d541944904
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c942013fed8950f66f8d02f0a0e710a3b9edbcb404852aa89e28d517ba292d3
0ecaf1ce9b0ffdc9b0c4d90c685ea025673e26adc0a2ce6c00cccd9ccba32227
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1270a862b7759b86d679ce76254e22bcd758959c10543bd38d451a9ef6c38004
153979cf61d1e2a8b808c144bd78bf2acc35f5ed0a9df200f271403cee07bd2e
18f9e6b96e326a7aa705c687fc8893c6b2df53acce477aefe2d0239d7b82fcb5
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1cc5573434bc9b7f1f814fa8ec4014b19334c45b6711b67fd55ea00ebb1427ac
21891543f19b0f6f617591cd5b4624a09f0d74d01b3e9836bca0af56ddea6973
2f8c3c6d1db89f53ba1b8dc6a66c5fb7658b90222ae7d679324fbdb652d417e3
34c2d21f4739dfe70913b840b2cf1971109fb912d62b476f65270d75393ec22c
35aba1fa92af31c456fcae1d5ff5bad246f7856c4f3b3ab742cb99d64357a486
380dbf2e9d1a28e9b2e7999c8a9adfe91b26f97b8f8e532872005452f1269389
387e8b5019922c28cdc230b2cb4eb495b498aa0457bba42eb16d690e36773942
392ed442867566d8cbd08f7e0d9a379c49177a9c96186ad0d1eba1a316721267
3b843d8505c200af17cdbf0a534faf3a5e6d41e67068387787984470ea717c97
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
51809bc55f512c21a3829627405dfec8796820392303908a9e011691de6f79f7
54896675b7106c6b98177ba7d084ceba5f47ed591eb393286a7a65f6bdb185ad
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
5a36bfb7995c90e80bc907138d7f0dd0193ea597c39e0e2a03825456b108c5d9
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5bd6464d825962c78212f6b36e884c48b3f2c3dd030d8b8df5760ecc59a0b55b
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
7152ee0c49420d49c94a0d91cedafb4747835e0679cfeab4b640e28d719f257b
7462356b4d60b272317657dfd4ffbfa221d3387d863a4f86751664623a645363
787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ddc1f3125c1c3c3e6cb0422f65eedddac57fc4716d5a88e4c947b0065a8ae95
8396a04c9c0c0fcca7cb3cfd84ea991182df2d1074dbfc1562d50fa47af70592
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86e496b536b26ba60cdb68df9dd9143b19a63b65e30e373b0321833aab1295d6
872962a39642df646762f1901ad135e2def759171f1dd12e40c38cb89b906015
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
8e4560c16c7970efa47680450b2cf239d4a482c056d308acea12bb9022906c8b
95315f38b7443633802f5f6b7838553762350dc909f6a9038185042923c7dc34
9573e6cd85da47a78444a5b75524918441848898e3424a81a47421e59d478166
9b9661d9e08e91d45ab439abc3e516d809cedcac6cf4254716d40c8fae3a74c3
9cb4461317e9e6ceb9f0d5caead26d22f0ecb04de4652ec3310f0cef340dfc4b
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a84e8111d0e249e7c77bdc68dbb26edbf9c6a6b1499489ee9309c04b54e4c091
ab43cf929d649dba8ce38c92dec4849c8049b678fec9942ae08df5ca57757280
ac5557f0b22983a696a6c891d0081a4f31ed4e0e09727c01ce0a86c05df07868
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b8a2fbd39f5894181c5d653f15572a9bc48297d6b5fe7826d28f2c485a229001
b8c490e04a2be43d25df6263307477469d6ef82a318809f800bedda65c4803b0
b9387b04310ec91bcec39955cca94fd387b1d66ab822733a6f713df6e61c8b23
bfcb3e50985adb6ff0658907b867d93113fb072efb3233f2482463cf833e08a0
c221b3da72f02e13bb4448c744da4d4125a5c69142cb0f41d69bebe0c9c0c8dd
c324557a4b9d514997074f610710ebfa75f6c047db6ac1d6f5d620e8e7145b96
c813c425e94940f8d5969ad279d87087c465249b40838bf4050dc35ee2bd89b0
c9a19a60288cb8fcdc282ec2b9e73745e52d6e1f7ab4d48836c6b0db75cae129
cce3d886a2dac25f1992bbcb994e3bd9b9c3aa5984cc418080af148ea3246d14
d08e946f4033fc38f58ef7a2f24a3ce4fa759f357ffaafec352e03a927558f08
d1b4c569f8b58b11ecb29e62c57bc3e90d41e097e5afdbb25398fe8ec57070e9
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
daccba7f51292ba5909197ba9204303ad6c7d826af2f02bb21beaea69d2bfdb7
df5c2c0aba6821732a4f4e71875e3a4a24d1d2e5ee3a25c5d0b44b7a5a8ee9f7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e83d4103d5a08ee59708b55d4bf32e1c8cf7579deff6f80cbcad67b1048bdedf
ec2cc99b7d1be6fb64d9ce3622e5584e39002529d87a71ffad76435b800de309
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efd19dfec4bcda76629c1a8f02bbe3163e5018bc26eae676b24bd0153e739eb5
f0bb1418067db6f87b117bac092942db1ac59941666282df6d4d2898a65b4d2c
f19dc5236e8103e0dd9a481921ed628531f6bfaf4fd1eb750db2c18d5822415f
fa1082f8ca5c3c5a9638f0f020cfdfa2acfe5c428da851467795170e2440fef9
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fd605d875d563aad8e8646a01b7058f136b6e011afee6d9b6755d40d699c4ada

checkout.newsobserver.com Open in urlscan Pro 20.76.203.173 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

122 Requests

96 %HTTPS

44 %IPv6

22 Domains

37 Subdomains

31 IPs

6 Countries

2992 kBTransfer

7006 kBSize

26 Cookies

4 Outgoing links

Page URL History

Redirected requests

122 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

checkout.newsobserver.com Open in urlscan Pro
20.76.203.173 Public Scan

Screenshot
Live screenshot

Full Image

122
Requests

96 %
HTTPS

44 %
IPv6

22
Domains

37
Subdomains

31
IPs

6
Countries

2992 kB
Transfer

7006 kB
Size

26
Cookies

122 HTTP transactions
0 data transactions